In ConcurrentSessionControlStrategy, when expiring the least recently used session, expireNow() is called on the SessionInformation object, but nothing is done to persist this to the SessionRegistry. This works fine for the default, in memory, SessionRegistry implementation, but, with a non-in-memory implementation, it appears that the session will never be expired in the registry. In fact, there is no interface on the SessionRegistry which would allow this to be persisted. Am I missing something, or is this an oversight?