I would like to capture the login, logout, and session timeout events. I have been able to successfully capture each one. For session timeout, I implemented

public class SessionDestroyedListener implements ApplicationListener<SessionDestroyedEvent>

While I can capture the event, I would also like to know whose session was timed out. For this I tried to call:

public void onApplicationEvent(SessionDestroyedEvent event) {
List<SecurityContext> securityContexts = event.getSecurityContexts();

Each time the method is called, my securityContexts list is empty. Am I doing something wrong? Should I be able to retrieve the user's ID whose session just timed or was destroyed for any reason?