Describe the bug https://docs.spring.io/spring-security/reference/servlet/oauth2/login/logout.html states that you need a way listen to events published by Spring Security to remove old OidcSessionInformation entries, like so:

@Bean
public HttpSessionEventListener sessionEventListener() {
    return new HttpSessionEventListener();
}

However HttpSessionEventListener.java does not exist. It took me a while to figure out that what you need instead is an HttpSessionEventPublisher like so:

@Bean
public HttpSessionEventPublisher httpSessionEventPublisher() {
    return new HttpSessionEventPublisher();
}

Please update the documentation :) Thank you.