Store last account activity information in database with Spring Security

Task

Store last account activity information in database.

Realization

There are several ways to listen events related to session in Spring Security by implementing some of these listeners:

• javax.servlet.http.SessionAttributesListener
• javax.servlet.http.HttpSessionListener 
• org.springframework.context.ApplicationListener

I found information, that the best way is to use Spring Application Listener

Don't use a HttpSessionListener for this as there is no garantuee that Spring Security will intiate the session creation or maybe even worse it destroys and creates a session (depending on your session strategy). [1] 

It's possible to track many different useful application events with implemented custom Application Listener. For instance, AuthorizationFailureEvent, AuthenticationCredentialsNotFoundEvent  or AuthenticationSuccessEvent [2].

Adding successful login event listener and logout/session timeout event listener

Problem: newly created session is replaced by a new one with copied data

By default, in all type of listeners, after user logged in, newly created session is replaced by a new one with copied data. This is because Spring Security automatically protects against Session Fixation Attack [3]. SessionFixationProtectionStrategy re-creates new session by calling onAuthentication method. SessionFixationProtectionStrategy  performs it after authentication with success, copy all attributes from session, invalidate the session, next create a new session and write into the session the attributes [4]. 

Solution

• To get actual session id, it's possible to override the behaviour of org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy
• Turn off Session Fixation Attack protection by changing <session-fixation-protection> attribute on <session-management> in security configuration

I have chosen second solution
So I will have chance to check session fixation attack on my project. More about this attack: https://www.owasp.org/index.php/Session_fixation