How to ensure the same account is not used to log in two different people at the same time in Spring Security?

Question

I have a Spring MVC app that does not protect updates of user data with transactions.

It assumes that only a single user is accessing the account data for that account at any one time.

However, if two users were to log in using the same authentication credentials, it is theoretically possible, although unlikely, for two database updates on the same user data to overlap and conflict.

Is there a simple way to protect against this in Spring Security?

Answer 1

Spring Security supports protection against concurrent logins. See 2.3.3 Session Management for instructions of how to enable it.

Answer 2

Add a column to the user database called "logged in". If that value is set, then refuse a second login.