Online/offline status in Spring Security - spring-security

Question

In my web application I need to know whether users are online or offline. I need to update the status in the database whenever users' sessions are created or destroyed, so SessionRegistry is not an option.
I implemented it using session counters - when a user logs in, his counter increments, when he logs out or his session times out, his counter decrements.
web.xml
<listener>
<listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>
Service
#Service
public class UsersLoginLogoutListener implements ApplicationListener<ApplicationEvent> {
#Autowired
private AccountService accountService;
public void onApplicationEvent(ApplicationEvent event) {
if (event instanceof InteractiveAuthenticationSuccessEvent) { // User log in
System.out.println("User logged in...");
InteractiveAuthenticationSuccessEvent iasEvent = (InteractiveAuthenticationSuccessEvent) event;
String userName = iasEvent.getAuthentication().getName();
if (userName != null) {
System.out.println("...username is " + userName + ".");
accountService.incrementSessionCounter(userName);
}
}
else if (event instanceof SessionDestroyedEvent) { // User log out / session timeout
System.out.println("User logged out or session timeout...");
SessionDestroyedEvent sdEvent = (SessionDestroyedEvent) event;
List<SecurityContext> lstSecurityContext = sdEvent.getSecurityContexts();
System.out.println("...SecurityContexts list size: " + lstSecurityContext.size() + "...");
for (SecurityContext securityContext : lstSecurityContext)
{
String userName = securityContext.getAuthentication().getName();
if (userName != null) {
System.out.println("...username is " + userName + ".");
accountService.decrementSessionCounter(userName);
}
}
}
}
}
It's been working just fine until recently, when I noticed that one counter was incremented, but never was decremented. Thanks to the logs I was able to reproduce it.
A user opens login pages in two browser tabs and logs in on one tab, then he logs in on another tab without logging out on the first tab. If he entered the correct credentials everything works fine:
User logged in... ...username is testuser.
User logged out or session timeout... ...SecurityContexts list size:
1... ...username is testuser.
User logged in... ...username is testuser.
Even though he logged in twice using the same browser, his first session was destroyed and my counter worked correctly.
But if he entered incorrect credentials, I see the following output:
User logged in... ...username is testuser.
(After session timeout)
User logged out or session timeout... ...SecurityContexts list size:
0...
As you can see, in this case SessionDestroyedEvent was fired, but only after the session timeout and SecurityContexts list was empty, so user's session counter wasn't decremented.