Problems with improper access to urls in the application with Spring Security

You can create a configuration that will control the sessions per user, avoiding this 'session affinity' that your app is creating.

For example, define a class that limits to one session per person.

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    FindByIndexNameSessionRepository<ExpiringSession> sessionRepository;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
            http
                    // other config goes here...
                    .sessionManagement()
                            .maximumSessions(1)
                            .sessionRegistry(sessionRegistry());
    }

    @Bean
    SpringSessionBackedSessionRegistry sessionRegistry() {
            return new SpringSessionBackedSessionRegistry(this.sessionRepository);
    }
}

link