{"record":{"id":"9bbab40866fa4bb0","repo":"spring-projects/spring-security","slug":"could-not-create-a-default-servermaximumsessionsex","errorCode":null,"errorMessage":"Could not create a default ServerMaximumSessionsExceededHandler. Please provide a ServerMaximumSessionsExceededHandler via DSL","messagePattern":"Could not create a default ServerMaximumSessionsExceededHandler\\. Please provide a ServerMaximumSessionsExceededHandler via DSL","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java","lineNumber":1558,"sourceCode":"\t\t\t\tSessionRegistryWebFilter sessionRegistryWebFilter = new SessionRegistryWebFilter(\n\t\t\t\t\t\treactiveSessionRegistry);\n\t\t\t\tconfigureSuccessHandlerOnAuthenticationFilters();\n\t\t\t\thttp.addFilterAfter(sessionRegistryWebFilter, SecurityWebFiltersOrder.HTTP_HEADERS_WRITER);\n\t\t\t}\n\t\t}\n\n\t\tprivate ServerMaximumSessionsExceededHandler getMaximumSessionsExceededHandler() {\n\t\t\tif (this.maximumSessionsExceededHandler != null) {\n\t\t\t\treturn this.maximumSessionsExceededHandler;\n\t\t\t}\n\t\t\tDefaultWebSessionManager webSessionManager = getBeanOrNull(\n\t\t\t\t\tWebHttpHandlerBuilder.WEB_SESSION_MANAGER_BEAN_NAME, DefaultWebSessionManager.class);\n\t\t\tif (webSessionManager != null) {\n\t\t\t\tthis.maximumSessionsExceededHandler = new InvalidateLeastUsedServerMaximumSessionsExceededHandler(\n\t\t\t\t\t\twebSessionManager.getSessionStore());\n\t\t\t}\n\t\t\tif (this.maximumSessionsExceededHandler == null) {\n\t\t\t\tthrow new IllegalStateException(\n\t\t\t\t\t\t\"Could not create a default ServerMaximumSessionsExceededHandler. Please provide \"\n\t\t\t\t\t\t\t\t+ \"a ServerMaximumSessionsExceededHandler via DSL\");\n\t\t\t}\n\t\t\treturn this.maximumSessionsExceededHandler;\n\t\t}\n\n\t\tprivate void configureSuccessHandlerOnAuthenticationFilters() {\n\t\t\tif (ServerHttpSecurity.this.formLogin != null) {\n\t\t\t\tServerHttpSecurity.this.formLogin.defaultSuccessHandlers.add(0, this.authenticationSuccessHandler);\n\t\t\t}\n\t\t\tif (ServerHttpSecurity.this.oauth2Login != null) {\n\t\t\t\tServerHttpSecurity.this.oauth2Login.defaultSuccessHandlers.add(0, this.authenticationSuccessHandler);\n\t\t\t}\n\t\t\tif (ServerHttpSecurity.this.httpBasic != null) {\n\t\t\t\tServerHttpSecurity.this.httpBasic.defaultSuccessHandlers.add(0, this.authenticationSuccessHandler);\n\t\t\t}\n\t\t}\n","sourceCodeStart":1540,"sourceCodeEnd":1576,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java#L1540-L1576","documentation":"When session concurrency control is configured, ServerHttpSecurity needs a ServerMaximumSessionsExceededHandler. It tries to build a default from the WebSessionManager's session store (InvalidateLeastUsed...), and if no WebSessionManager bean of the expected type exists and none was supplied via DSL, it throws this IllegalStateException.","triggerScenarios":"Using sessionManagement(maximumSessions...) in reactive config while the context lacks a WebSessionManager bean named 'webHttpHandlerBuilder.webSessionManager' (e.g. a custom SessionManager implementation) and no maximumSessionsExceededHandler is set in the DSL.","commonSituations":"Applications with a custom reactive session management setup (e.g. custom WebSessionManager without a SessionStore); tests with minimal context; switching session stores in a way the default handler factory does not recognize.","solutions":["Provide a ServerMaximumSessionsExceededHandler via the DSL: .sessionManagement(s -> s.maximumSessions(...).maxSessionsExceededHandler(handler))","Publish a standard DefaultWebSessionManager bean so the default InvalidateLeastUsedServerMaximumSessionsExceededHandler can be created","Ensure the WebSessionManager bean is registered under the expected WebHttpHandlerBuilder.WEB_SESSION_MANAGER_BEAN_NAME"],"exampleFix":"// before\nhttp.sessionManagement(s -> s.maximumSessions(SessionLimit.of(1)));\n\n// after\nhttp.sessionManagement(s -> s.maximumSessions(SessionLimit.of(1))\n    .maxSessionsExceededHandler(new InvalidateLeastUsedServerMaximumSessionsExceededHandler(sessionStore)));","handlingStrategy":"validation","validationCode":"boolean hasDefaultSource = context.getBeanNamesForType(DefaultWebSessionManager.class).length > 0\n    || maxSessionsExceededHandler != null;\nif (!hasDefaultSource) {\n  throw new IllegalStateException(\"Provide a ServerMaximumSessionsExceededHandler via DSL or a DefaultWebSessionManager bean\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When using maximumSessions in reactive apps, always set maxSessionsExceededHandler explicitly","Keep a standard DefaultWebSessionManager bean if relying on defaults","Re-check defaults after customizing WebSessionManager/SessionStore"],"tags":["reactive","session","spring-security","configuration"],"backgroundTag":"missing-required-config","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}