From 7222e992da924c977a64696ef4d0584f711a8b20 Mon Sep 17 00:00:00 2001
From: Ludy87 <Ludy87@users.noreply.github.com>
Date: Mon, 24 Mar 2025 00:50:32 +0100
Subject: [PATCH] Update UserAuthenticationFilter.java

---
 .../SPDF/config/security/UserAuthenticationFilter.java      | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/main/java/stirling/software/SPDF/config/security/UserAuthenticationFilter.java b/src/main/java/stirling/software/SPDF/config/security/UserAuthenticationFilter.java
index 61df11d15..89528c1da 100644
--- a/src/main/java/stirling/software/SPDF/config/security/UserAuthenticationFilter.java
+++ b/src/main/java/stirling/software/SPDF/config/security/UserAuthenticationFilter.java
@@ -71,6 +71,7 @@ public class UserAuthenticationFilter extends OncePerRequestFilter {
                     sessionPersistentRegistry.getAllSessions(username, false);
 
             int userSessions = allSessions.size();
+            int maxUserSessions = sessionPersistentRegistry.getMaxUserSessions();
 
             HttpSession session = request.getSession(false);
             if (session == null) {
@@ -79,13 +80,14 @@ public class UserAuthenticationFilter extends OncePerRequestFilter {
             }
             String sessionId = session.getId();
 
-            if (allSessions.size() > 2) {
+            if (userSessions > maxUserSessions) {
                 // Sortiere nach letzter Aktivität – älteste zuerst
                 List<SessionInformation> sortedSessions =
                         allSessions.stream()
                                 .sorted(Comparator.comparing(SessionInformation::getLastRequest))
                                 .collect(Collectors.toList());
-                int sessionsToExpire = allSessions.size() - 2;
+                int sessionsToExpire = userSessions - maxUserSessions;
+                log.info("Expire {} old sessions", sessionsToExpire);
                 for (int i = 0; i < sessionsToExpire; i++) {
                     SessionInformation oldSession = sortedSessions.get(i);
                     if (!sessionId.equals(oldSession.getSessionId())) {