@Override
public void configure(WebSecurity web) throws Exception {
 web.ignoring().antMatchers("/js/**", "/css/**", "/images/**");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
 http.authorizeRequests()
 ...
 .and()
 .formLogin()
 .loginPage("/login.html")
 .loginProcessingUrl("/doLogin")
 ...
 .and()
 .sessionManagement()
 .maximumSessions(1);
}

public class SessionRegistryImpl implements SessionRegistry,
 ApplicationListener<SessionDestroyedEvent> {
 /** <principal:Object,SessionIdSet> */
 private final ConcurrentMap<Object, Set<String>> principals;
 /** <sessionId:Object,SessionInformation> */
 private final Map<String, SessionInformation> sessionIds;
 public void registerNewSession(String sessionId, Object principal) {
 if (getSessionInformation(sessionId) != null) {
 removeSessionInformation(sessionId);
 }
 sessionIds.put(sessionId,
 new SessionInformation(principal, sessionId, new Date()));

 principals.compute(principal, (key, sessionsUsedByPrincipal) -> {
 if (sessionsUsedByPrincipal == null) {
 sessionsUsedByPrincipal = new CopyOnWriteArraySet<>();
 }
 sessionsUsedByPrincipal.add(sessionId);
 return sessionsUsedByPrincipal;
 });
 }
 public void removeSessionInformation(String sessionId) {
 SessionInformation info = getSessionInformation(sessionId);
 if (info == null) {
 return;
 }
 sessionIds.remove(sessionId);
 principals.computeIfPresent(info.getPrincipal(), (key, sessionsUsedByPrincipal) -> {
 sessionsUsedByPrincipal.remove(sessionId);
 if (sessionsUsedByPrincipal.isEmpty()) {
 sessionsUsedByPrincipal = null;
 }
 return sessionsUsedByPrincipal;
 });
 }

}

public class User implements UserDetails, CredentialsContainer {
 private String password;
 private final String username;
 private final Set<GrantedAuthority> authorities;
 private final boolean accountNonExpired;
 private final boolean accountNonLocked;
 private final boolean credentialsNonExpired;
 private final boolean enabled;
 @Override
 public boolean equals(Object rhs) {
 if (rhs instanceof User) {
 return username.equals(((User) rhs).username);
 }
 return false;
 }
 @Override
 public int hashCode() {
 return username.hashCode();
 }
}

@Entity(name = "t_user")
public class User implements UserDetails {
 @Id
 @GeneratedValue(strategy = GenerationType.IDENTITY)
 private Long id;
 private String username;
 private String password;
 private boolean accountNonExpired;
 private boolean accountNonLocked;
 private boolean credentialsNonExpired;
 private boolean enabled;
 @ManyToMany(fetch = FetchType.EAGER,cascade = CascadeType.PERSIST)
 private List<Role> roles;

 @Override
 public boolean equals(Object o) {
 if (this == o) return true;
 if (o == null || getClass() != o.getClass()) return false;
 User user = (User) o;
 return Objects.equals(username, user.username);
 }

 @Override
 public int hashCode() {
 return Objects.hash(username);
 }
 ...
 ...
}

public class Hr implements UserDetails {
 ...
 ...
 @Override
 public boolean equals(Object o) {
 if (this == o) return true;
 if (o == null || getClass() != o.getClass()) return false;
 Hr hr = (Hr) o;
 return Objects.equals(username, hr.username);
 }

 @Override
 public int hashCode() {
 return Objects.hash(username);
 }
 ...
 ...
}

@Bean
SessionRegistryImpl sessionRegistry() {
 return new SessionRegistryImpl();
}

@Bean
LoginFilter loginFilter() throws Exception {
 LoginFilter loginFilter = new LoginFilter();
 loginFilter.setAuthenticationSuccessHandler((request, response, authentication) -> {
 //省略
 }
 );
 loginFilter.setAuthenticationFailureHandler((request, response, exception) -> {
 //省略
 }
 );
 loginFilter.setAuthenticationManager(authenticationManagerBean());
 loginFilter.setFilterProcessesUrl("/doLogin");
 ConcurrentSessionControlAuthenticationStrategy sessionStrategy = new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry());
 sessionStrategy.setMaximumSessions(1);
 loginFilter.setSessionAuthenticationStrategy(sessionStrategy);
 return loginFilter;
}

@Override
protected void configure(HttpSecurity http) throws Exception {
 http.authorizeRequests()
 ...
 http.addFilterAt(new ConcurrentSessionFilter(sessionRegistry(), event -> {
 HttpServletResponse resp = event.getResponse();
 resp.setContentType("application/json;charset=utf-8");
 resp.setStatus(401);
 PrintWriter out = resp.getWriter();
 out.write(new ObjectMapper().writeValueAsString(RespBean.error("您已在另一臺(tái)設(shè)備登錄，本次登錄已下線!")));
 out.flush();
 out.close();
 }), ConcurrentSessionFilter.class);
 http.addFilterAt(loginFilter(), UsernamePasswordAuthenticationFilter.class);
}

public class LoginFilter extends UsernamePasswordAuthenticationFilter {
 @Autowired
 SessionRegistry sessionRegistry;
 @Override
 public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
 //省略
 UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
 username, password);
 setDetails(request, authRequest);
 Hr principal = new Hr();
 principal.setUsername(username);
 sessionRegistry.registerNewSession(request.getSession(true).getId(), principal);
 return this.getAuthenticationManager().authenticate(authRequest);
 } 
 ...
 ...
 }
}