Skip to content

Commit a362ab5

Browse files
avpolozeleftherias
authored andcommitted
Change guard expressions order
Check of allowed user sessions count moved to head for avoid unnecessary fetching all user sessions.
1 parent 9cf3129 commit a362ab5

File tree

1 file changed

+6
-6
lines changed

1 file changed

+6
-6
lines changed

web/src/main/java/org/springframework/security/web/authentication/session/ConcurrentSessionControlAuthenticationStrategy.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2019 the original author or authors.
2+
* Copyright 2002-2020 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -94,17 +94,17 @@ public ConcurrentSessionControlAuthenticationStrategy(SessionRegistry sessionReg
9494
@Override
9595
public void onAuthentication(Authentication authentication, HttpServletRequest request,
9696
HttpServletResponse response) {
97+
int allowedSessions = getMaximumSessionsForThisUser(authentication);
98+
if (allowedSessions == -1) {
99+
// We permit unlimited logins
100+
return;
101+
}
97102
List<SessionInformation> sessions = this.sessionRegistry.getAllSessions(authentication.getPrincipal(), false);
98103
int sessionCount = sessions.size();
99-
int allowedSessions = getMaximumSessionsForThisUser(authentication);
100104
if (sessionCount < allowedSessions) {
101105
// They haven't got too many login sessions running at present
102106
return;
103107
}
104-
if (allowedSessions == -1) {
105-
// We permit unlimited logins
106-
return;
107-
}
108108
if (sessionCount == allowedSessions) {
109109
HttpSession session = request.getSession(false);
110110
if (session != null) {

0 commit comments

Comments
 (0)