[SpringSecurity6] 自己扩展的 UsernamePasswordAuthenticationFilter 该怎样配置并发会话控制？

自己扩展的 UsernamePasswordAuthenticationFilter 该怎样配置并发会话控制？

自己谷歌了半天，应该是需要为自定义的 Filter 配置 SessionAuthenticationStrategy ，请老哥们帮我看看，是我哪里配的不对吗？

https://github.com/yodhcn/security-demo

public class MyUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter { @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException { return super.attemptAuthentication(request, response); } } 

@Configuration @EnableWebSecurity public class SecurityConfig { @Bean public HttpSessionEventPublisher httpSessionEventPublisher() { return new HttpSessionEventPublisher(); } @Bean public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception { return authenticationConfiguration.getAuthenticationManager(); } @Bean public SecurityContextRepository securityContextRepository() { return new DelegatingSecurityContextRepository( new HttpSessionSecurityContextRepository(), new RequestAttributeSecurityContextRepository() ); } @Bean public SessionRegistry sessionRegistry() { return new SessionRegistryImpl(); } @Bean public SessionAuthenticationStrategy authStrategy(SessionRegistry sessionRegistry) { List<SessionAuthenticationStrategy> delegateStrategies = new ArrayList<>(); ConcurrentSessionControlAuthenticationStrategy cOncurrentSessionControlAuthenticationStrategy= new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry); concurrentSessionControlAuthenticationStrategy.setMaximumSessions(1); // maximumSessions delegateStrategies.add(concurrentSessionControlAuthenticationStrategy); return new CompositeSessionAuthenticationStrategy(delegateStrategies); } @Bean MyUsernamePasswordAuthenticationFilter myUsernamePasswordAuthenticationFilter( AuthenticationManager authenticationManager, SecurityContextRepository securityContextRepository) { MyUsernamePasswordAuthenticationFilter filter = new MyUsernamePasswordAuthenticationFilter(); filter.setAuthenticationManager(authenticationManager); filter.setSecurityContextRepository(securityContextRepository); return filter; } @Bean public SecurityFilterChain filterChain( HttpSecurity http, MyUsernamePasswordAuthenticationFilter myUsernamePasswordAuthenticationFilter, SecurityContextRepository securityContextRepository ) throws Exception { http.authrizeHttpRequests() .anyRequest().authenticated(); http.sessionManagement().maximumSessions(1); // maximumSessions http.formLogin(); http.addFilterAt(myUsernamePasswordAuthenticationFilter, UsernamePasswordAuthenticationFilter.class); return http.build(); } @Bean public UserDetailsService userDetailsService() { UserDetails user = User.withDefaultPasswordEncoder().username("user").password("password").roles("USER") .build(); return new InMemoryUserDetailsManager(user); } }