Hi everyone. I’m using Spring Session Hazelcast in my stack. The ecosystem is composed by several microservices that are all connected as nodes on Hazelcast.
I’m facing an issue when trying to use those services with different versions of Spring Security. I basically get this error when I try do deserialize the session:
java.io.InvalidClassException: org.springframework.security.core.context.SecurityContextImpl; local class incompatible: stream classdesc serialVersionUID = 420, local class serialVersionUID = 520
MapSession object from Hazelcast, since this object contains Spring Security specific classes. But by the way Spring Session works, it seems to me that what goes into MapSession is out of our control (except for the Principal part)
SessionRegistry bean will not be automatically picked up when you are using concurrent session control with Spring Security.You will need to specify it in your Security DSL.
http
.sessionManagement { sessionManagement -> sessionManagement
.sessionConcurrency { sessionConcurrency -> sessionConcurrency
.maximumSessions(1)
.sessionRegistry(sessionRegistry())
}
}
@eleftherias Yep, I already added that on my SecurityConfig. By then I can @Autowire sessionRegistry right?
What if sessionRegistry always returns empty or 0, does that mean I have wrongly configured it?
And also will it also be the same if I am using HttpSessionJDBC?
SessionInformationExpiredStrategy and override onExpiredSessionDetected.You can then specify your custom strategy in the DSL
http
.sessionManagement()
.maximumSessions(1)
.expiredSessionStrategy(new CustomSessionInformationExpiredStrategy());
I started learning spring sessions. I started by HttpSession with Redis Guide.
The first problem I encounter is that the github repo does not contain the tips provided here.
Here is where I looked.
Any idea ?
@amirensit The Spring Boot Redis sample is intended to be simple, so that users can add the customizations that they need.
The additional properties mentioned in the documentation are not included in the sample because they are not applicable to all use-cases.
I can see that it confusing that we are not specifying the store-type in the Redis sample.
This is explained in the Spring Boot documentation:
If a single Spring Session module is present on the classpath, Spring Boot uses that store implementation automatically. If you have more than one implementation, you must choose the StoreType that you wish to use to store the sessions.
I have also created spring-projects/spring-session#1610 to clarify that part in the Spring Session docs.
setAttributes method you are referring to come from? Are you using Session.setAttribute(String attributeName, Object attributeValue. There are some examples using that function in the reference docs https://docs.spring.io/spring-session/docs/2.2.2.RELEASE/reference/html5/#api-session
SessionAuthenticationStrategy and on the onAuthentication I tried to get the user’s session, but it seem it can’t be found, maybe not created yet. When would be the best time to query the user’s session?
RegisterSessionAuthenticationStrategy is an example of getting the session from the request in the onAuthentication method. Perhaps you can follow the same pattern used there.This discussion is not specific to using spring-session, it is really about spring-security functionality.
It would be helpful if you could post any followup questions or comments in the
spring-security gitter instead.Keeping the topics separated like this can help anyone facing the same issue easily find this discussion.
Hey there spring-session experts!
I'm hoping someone here will be willing to help solve an issue I have with our SB 1.5.22 application with spring-session and JDBC:
Any transactions that occur on a separate thread (most common use case is inside of methods annotated with @Scheduled), are marked as NOT_ACTIVE as the TransactionStatus, so they don't commit.
If I remove spring session by setting
spring.session.store-type=none
the transactions are marked as ACTIVE and commit successfully.
Perhaps there is a configuration I missed or had already configured our application incorrectly.
Where should I start?
8 replies
http.sessionManagement().maximumSessions(1)And that works. Which surprises me.
I did not do
.sessionRegistry(sessionRegistry()) as documented at https://docs.spring.io/spring-session/docs/current/reference/html5/#spring-security-concurrent-sessionsSo it seems that
.sessionRegistry(sessionRegistry()) is not necessary leading me to believe that the documentation should be updated to remove this step.Thoughts?
Hello, I have a strange issue during the initialization of Redis data session. : org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'redisMessageListenerContainer' defined in class path resource [org/springframework/session/data/redis/config/annotation/web/http/RedisHttpSessionConfiguration.class]: Unsatisfied dependency expressed through method 'redisMessageListenerContainer' parameter 1; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'sessionRepository' defined in class path resource [org/springframework/session/data/redis/config/annotation/web/http/RedisHttpSessionConfiguration.class]: Initialization of bean failed; nested exception is java.lang.IllegalStateException: Encountered invalid @Scheduled method 'cleanupExpiredSessions': For
input string: "${spring.session.cleanup.cron.expression:0"
Seems that the spring.session.cleanup.cron.expression: does not properly read the value it has .. and reads only the fires 0 from the cron. (Spring Session 1.3.5 / Regular spring MVC configuration)
As I see there is a scheduled clean up task for expired sessions in JDBC solutions. How about in memory ones? Are session evictions from datastore completely up to in memory store - other than the expiry check when a session is fetched from the session repository? I wonder what happens when no eviction size/policy is set for the data store and a session is never fetched from the repository after it's created. In that case, will the session live forever in data store?
"SELECT S.SESSION_ID, S.CREATION_TIME, S.LAST_ACCESS_TIME, S.MAX_INACTIVE_INTERVAL, SA.ATTRIBUTE_NAME, SA.ATTRIBUTE_BYTES " +
"FROM %TABLE_NAME% S " +
"LEFT OUTER JOIN %TABLE_NAME%_ATTRIBUTES SA ON S.SESSION_ID = SA.SESSION_ID " +
"WHERE S.SESSION_ID = ?";
I'm reaching out here in hopes that someone will be able to help. We've recently upgraded from Zuul (backed by JDBC for session persistence) to Spring Cloud Gateway, (running Netty) using Redis for the sessions. We're seeing a large number of IllegalStateException: Session was invalidated exceptions.
Digging through the code we see that this exception gets thrown if/when the session doesn't exist, however, I'm not entirely sure I understand the conditions by which this can happen and how/why we're seeing this exception so often. The exception in itself isn't a big deal, however, we also observe that occasionally we get stuck in a strange loop whereby user's can't seem to establish a new session successfully and Gateway serves up a 500 with [authorization_request_not_found] error. If I monitor the redis commands I can see the hset commands but it continuously fails.
Unfortunately I can't figure out a consistent pattern to repro this (making it increasingly more frustrating) and I'm hoping someone can provide some insight.
Thanks
Hello All,
I have a java application and I use spring-session backed by redis for that. I have another application written in PHP which is hosted on same domain. Some requests go to that php application as well. I want to have some mechanism where a user first lands on java application. Shall authenticate and now a cookie shall be created. Now when hits some pages which are in PHP, I want the php application to work seamlessly and use java created session for authentication.
Question 1: Is it possible to do ?
Question 2: If answer to above question is yes, then how ?
Looking forward to suggestions/comments/help.
Is there any way I can set and get session attributes in the server itself when the redis goes down ? I searched for solutions in stackoverflow but reaching questions with no answers. Any suggestions or approaches for this scenario? Thanks
I plugged it in a backend and was surprised by the added latency, about 60 msec in my case. For simple web requests that do not modifiy the HttpSession I counted 9 Redis calls (the commands are : HGETALL, HMSET, SADD, PEXPIRE, APPEND, PEXPIRE, PEXPIRE, HGETALL, HGETALL). That seems high.
Question 1 : is it normal ?
Question 2 : is there tuning or optimization to reduce the Spring Session Redis latency ?
Question 3 : could using a different store (MongoDB or other) reduce the Spring Session latency ?
Thank you for your help.
