WARNING: Possible error: Filters are both instances of org.springframework.security.web.session.SessionManagementFilter - spring

Question

I'm developing a web application using Spring MVC and Spring security. Actually I do not have an error but a warning instead. It looks like this warning will come up with an error soon:)
When I try to deploy my application, it is deployed successfully but a warning appears:
"WARNING: Possible error: Filters at position 7 and 8 are both instances of org.springframework.security.web.session.SessionManagementFilter"
I have both sessionManagementFilter and preAuthenticationFilter in my spring-security xml.
I've googled the problem but it looks like there is not anybody that gets the same warning. What is this warning? Will it cause an error and how can I fix it? I cannot solve the issue, I'll be appreciated if someone helps me. Thank you.
My spring-security.xml:
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<http create-session="never" use-expressions="true" auto-config="false" entry-point-ref="preAuthenticatedProcessingFilterEntryPoint">
<custom-filter ref="sessionManagementFilter" before="SESSION_MANAGEMENT_FILTER" />
<intercept-url pattern="/restricted/**" access="isAuthenticated()" />
<custom-filter position="PRE_AUTH_FILTER" ref="myPreAuthFilter" />
<session-management>
<concurrency-control max-sessions="1" error-if-maximum-exceeded="false" expired-url="/invalid-session.xhtml?concurrent=true" />
</session-management>
<logout logout-url="/cikis" invalidate-session="true" delete-cookies="JSESSIONID" success-handler-ref="myLogoutHandler" />
</http>
<beans:bean id="myLogoutHandler" class="com.test.MyLogoutHandler" />
<beans:bean id="userDetailsServiceImpl" class="com.test.UserDetailsServiceImpl" />
<beans:bean id="preAuthenticatedProcessingFilterEntryPoint" class="com.test.ForbiddenURLEntryPoint" />
<beans:bean id="preAuthenticationProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
<beans:property name="preAuthenticatedUserDetailsService" ref="userDetailsServiceImpl" />
</beans:bean>
<beans:bean id="myPreAuthFilter" class="com.test.MyPreAuthenticationFilter">
<beans:property name="authenticationManager" ref="appControlAuthenticationManager" />
</beans:bean>
<beans:bean id="sessionManagementFilter" class="org.springframework.security.web.session.SessionManagementFilter">
<beans:constructor-arg name="securityContextRepository" ref="httpSessionSecurityContextRepository" />
<beans:property name="invalidSessionStrategy" ref="jsfRedirectStrategy" />
</beans:bean>
<beans:bean id="jsfRedirectStrategy" class="com.test.JsfRedirectStrategy"/>
<beans:bean id="httpSessionSecurityContextRepository" class="org.springframework.security.web.context.HttpSessionSecurityContextRepository"/>
<authentication-manager alias="appControlAuthenticationManager">
<authentication-provider ref="preAuthenticationProvider" />
</authentication-manager>
</beans:beans>

Answer 1

Spring security includes SessionManagementFilter by default on startup.
If you want to specify your own SESSION_MANAGEMENT_FILTER you have to disable session-fixation-protection, just type:
<http create-session="never" use-expressions="true" auto-config="false" entry-point-ref="preAuthenticatedProcessingFilterEntryPoint">
<session-management session-fixation-protection="none"/>
<custom-filter ref="sessionManagementFilter" before="SESSION_MANAGEMENT_FILTER" />
<...>
</http>