In my understanding the following Security configuration should forward to /login Page after the session is invalidated:
...
@Override
protected void configure(final HttpSecurity http) throws Exception {
http.authorizeRequests().antMatchers("/vendors/**", "/build/**", "/images/**", "/favicon.ico", "/robots.txt").permitAll().anyRequest().authenticated().and().formLogin().loginPage("/login").permitAll().defaultSuccessUrl("/").successHandler(loginSuccessHandler)
.permitAll().and().sessionManagement().maximumSessions(1).and().invalidSessionUrl("/login").and().logout().invalidateHttpSession(true);
}
....
In my application.properties i add
server.servlet.session.timeout=60s
But, it seems not being invalidated nor will the /login page be called. The webapp works still and no action due to sessionmanagement is performed. Where is my misunderstanding?