vpavic on 2.0.x
Ignore failed rename operation … (compare)
Hey there spring-session experts!
I'm hoping someone here will be willing to help solve an issue I have with our SB 1.5.22 application with spring-session and JDBC:
Any transactions that occur on a separate thread (most common use case is inside of methods annotated with @Scheduled), are marked as NOT_ACTIVE as the TransactionStatus, so they don't commit.
If I remove spring session by setting
spring.session.store-type=none
the transactions are marked as ACTIVE and commit successfully.
Perhaps there is a configuration I missed or had already configured our application incorrectly.
Where should I start?
http.sessionManagement().maximumSessions(1)
.sessionRegistry(sessionRegistry())
as documented at https://docs.spring.io/spring-session/docs/current/reference/html5/#spring-security-concurrent-sessions.sessionRegistry(sessionRegistry())
is not necessary leading me to believe that the documentation should be updated to remove this step.Hello, I have a strange issue during the initialization of Redis data session. : org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'redisMessageListenerContainer' defined in class path resource [org/springframework/session/data/redis/config/annotation/web/http/RedisHttpSessionConfiguration.class]: Unsatisfied dependency expressed through method 'redisMessageListenerContainer' parameter 1; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'sessionRepository' defined in class path resource [org/springframework/session/data/redis/config/annotation/web/http/RedisHttpSessionConfiguration.class]: Initialization of bean failed; nested exception is java.lang.IllegalStateException: Encountered invalid @Scheduled method 'cleanupExpiredSessions': For
input string: "${spring.session.cleanup.cron.expression:0"
Seems that the spring.session.cleanup.cron.expression: does not properly read the value it has .. and reads only the fires 0 from the cron. (Spring Session 1.3.5 / Regular spring MVC configuration)
I'm reaching out here in hopes that someone will be able to help. We've recently upgraded from Zuul (backed by JDBC for session persistence) to Spring Cloud Gateway, (running Netty) using Redis for the sessions. We're seeing a large number of IllegalStateException: Session was invalidated
exceptions.
Digging through the code we see that this exception gets thrown if/when the session doesn't exist, however, I'm not entirely sure I understand the conditions by which this can happen and how/why we're seeing this exception so often. The exception in itself isn't a big deal, however, we also observe that occasionally we get stuck in a strange loop whereby user's can't seem to establish a new session successfully and Gateway serves up a 500 with [authorization_request_not_found]
error. If I monitor the redis commands I can see the hset commands but it continuously fails.
Unfortunately I can't figure out a consistent pattern to repro this (making it increasingly more frustrating) and I'm hoping someone can provide some insight.
Thanks
Hello All,
I have a java application and I use spring-session backed by redis for that. I have another application written in PHP which is hosted on same domain. Some requests go to that php application as well. I want to have some mechanism where a user first lands on java application. Shall authenticate and now a cookie shall be created. Now when hits some pages which are in PHP, I want the php application to work seamlessly and use java created session for authentication.
Question 1: Is it possible to do ?
Question 2: If answer to above question is yes, then how ?
Looking forward to suggestions/comments/help.
Hi, anyone can help me getting through this documentation?
https://docs.spring.io/spring-session/docs/current/reference/html5/#rest-spring-configuration
I use @EnableRedisHttpSession
as per documentation and the REST API works as expected. However, it causes WebSocket API to not work as expected since Spring Session provides the Session ID through X-Auth-Token
header instead of Cookie
header.
Right now my goal is to retrieve Principal
using X-Auth-Token
, so I can create a ChannelInterceptor.
Thank you!
Hi, can anyone help on getting spring session and hazelcast deployed in weblogic working? We have a form-based authentication based on j_security_check and deployed in weblogic 12.2.1.4. It was an old app with uses spring for IOC and DI purposes only. It did not use spring security as it has its own custom security. Right now, the team decided to use spring session backed with hazelcast. After putting the necessary configuration for both spring session and hazelcast, we have noticed that servlet container HTTP session is replaced with spring session. Able to get a successful response on the first call. However, succeeding requests seems always redirected to login page. And noticed as well that original cookie issued by the servlet container has been replaced by spring session through DefaultCookieSerializer. This I suspect is the root cause of the problem. Below is the related configuration for spring session and hazelcast:
Entry in my session config XML file:
<context:annotation-config/>
<bean class="org.springframework.session.hazelcast.config.annotation.web.http.HazelcastHttpSessionConfiguration"/>
<bean id="hazelcastInstance" class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
<property name="staticMethod" value="com.silverlakesymmetri.cbs.commons.cache.CbsHazelcastProvider.getInstance"/>
</bean>
<bean class="org.springframework.session.web.http.DefaultCookieSerializer">
<property name="cookieName" value="JSESSIONID"/>
<property name="cookiePath" value="/"/>
<property name="domainNamePattern" value="^.+?\.(\w+\.[a-z]+)$"/>
</bean>
And the corresponding configuration for web.xml:
<filter>
<filter-name>springSessionRepositoryFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSessionRepositoryFilter</filter-name>
<url-pattern>/rs/</url-pattern>
</filter-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:application-context.xml</param-value>
</context-param>
Does spring session need to be always partnered with spring security? Is there any configuration which need to be added to make it work? I have been working on it for a week now and could not find a way to make it working.
Please advise.
Thank you in advance.
@lbatulan
Does spring session need to be always partnered with spring security? Is there any configuration which need to be added to make it work? I have been working on it for a week now and could not find a way to make it working.
i thought so but it's not the case
but you somehow need something to serve as the session key
with spring security, it's easily done
here's an example without spring security
the key extractor
https://github.com/hazelcast-demos/zerodowntime/blob/master/app/src/main/java/org/hazelcast/zerodowntime/CustomerIdExtractor.java
and its configuration
https://github.com/hazelcast-demos/zerodowntime/blob/master/app/src/main/java/org/hazelcast/zerodowntime/ZerodowntimeApplication.java#L38-L47
@nfrankel , thank you for the response and also for a sample reference implementation using key extractor, I really appreciate it. Right now, I resolved the issue by changing the HTTP session strategy from cookie based to header based.
Here are the steps I made:
1.) In my spring session XML configuration, I removed the entry related to cookie serializer to change the cookie name.
<bean class="org.springframework.session.web.http.DefaultCookieSerializer">
<property name="cookieName" value="JSESSIONID"/>
<property name="cookiePath" value="/"/>
<property name="domainNamePattern" value="^.+?\.(\w+\.[a-z]+)$"/>
</bean>
2.) Added below entry in spring session XML configuration to use header based instead of cookie based strategy.
<bean id="httpSessionStrategy" class="org.springframework.session.web.http.HeaderHttpSessionStrategy"/>
3.) Then on every request, I am passing x-auth-token
in the http request header.
Also posted the same solution in stackoverflow hoping to help others who have encountered the same. Stackoverflow post is here.
I'm wondering if anyone has experienced a situation with Spring Session and Redis whereby cache values grow massively - to the point where it takes down the cache cluster?
We've had no issues up till about a week ago and then suddenly OAuth requests began failing. Looking at our cache we saw some of the steps in the OAuth flow cached but (what appeared to be) appended to one-another - to the tune of GB / key (org.springframework.security.oauth2.client.web.server.WebSessionOAuth2ServerAuthorizationRequestRepository.AUTHORIZATION_REQUEST)
We have exhausted so many possibilities in our ecosystem so I'm reaching out here in hopes that this is familiar to someone.
PreAuthenticatedAuthenticationToken
it at least lets me assume that this is the right way to got. But a PAT is not a preauthentication, it still needs to be validated
Hello.
I upgraded my spring-security and spring-session dependencies from 5.3 to 5.5.
At first, I got the unable to Deserialize exception because of not matching SerialVersionUIDs. This I solved by clearing my 'spring_session' tables.
But now, I get the following Exception:
java.io.InvalidClassException: filter status: REJECTED\n\tat java.io.ObjectInputStream.filterCheck(ObjectInputStream.java:1287)\n\tat java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1896)\n\tat java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1772)\n\tat java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2060)\n\tat java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1594)\n\tat java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2355)\n\tat java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2249)\n\tat java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2087)\n\tat java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1594)\n\tat java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2355)\n\tat java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2249)\n\tat java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2087)\n\tat java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1594)\n\tat java.io.ObjectInputStream.readObject(ObjectInputStream.java:430)\n\tat o.s.core.serializer.DefaultDeserializer.deserialize(DefaultDeserializer.java:72)\n\tat o.s.core.serializer.support.DeserializingConverter.convert(DeserializingConverter.java:73)\n\t... 50 common frames omitted\nWrapped by: <#ada2f674> o.s.c.s.support.SerializationFailedException: Failed to deserialize payload. Is the byte array a result of corresponding serialization for DefaultDeserializer?; nested exception is java.io.InvalidClassException: filter status: REJECTED\n\tat o.s.core.serializer.support.DeserializingConverter.convert(DeserializingConverter.java:78)\n\tat o.s.core.serializer.support.DeserializingConverter.convert(DeserializingConverter.java:36)\n\tat o.s.c.c.s.GenericConversionService$ConverterAdapter.convert(GenericConversionService.java:386)\n\tat o.s.core.convert.support.ConversionUtils.invokeConverter(ConversionUtils.java:41)\n\t... 47 common frames omitted\nWrapped by: <#059e6091> o.s.core.convert.ConversionFailedException: Failed to convert from type [byte[]] to type [java.lang.Object] for value '{-84, -19
Can anybody help me?
Context: I'm using KeyCloak also in my application if that helps.
Thanks :)
Hi, excuse me. I'm trying to implement simple flux redis session + spring security. I've next configuration:
@Configuration
@EnableRedisWebSession
public class SecurityConcern {
// Security filters configuration -----------
@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
http.httpBasic();
http.authorizeExchange().anyExchange().authenticated();
return http.build();
}
// -------------------------------------------
// Session management configuration ----------
@Bean
public LettuceConnectionFactory connectionFactory() {
return new LettuceConnectionFactory();
}
// ------------------------------------------
}
But with the Redis monitor I don't see that it saves any session, although it does return the session id (UUID, I'm printing it with this next controller):
@GetMapping("/test_session")
public Mono<String> testSession(WebSession session) {
return Mono.just(session.getId());
}
Suddenly I'm missing something? I also tried injecting (autowired) the redis template that autoconfigures and saves me in redis without problem.
When I try to upgrade Spring Boot, Security and Session to 2.7.0, I got below error
Caused by: org.springframework.core.serializer.support.SerializationFailedException: Failed to deserialize payload. Is the byte array a result of corresponding serialization for DefaultDeserializer?; nested exception is java.io.InvalidClassException: org.springframework.security.core.context.SecurityContextImpl; local class incompatible: stream classdesc serialVersionUID = 560, local class serialVersionUID = 570
Anyone seeing this?
Hello, we use the 2.6.2 version of spring-boot-starter-security
, spring-boot-starter-data-redis
and spring-session-data-redis
. As we update the Spring version, our sessions deserialization fails with an error
Caused by: org.springframework.core.serializer.support.SerializationFailedException: Failed to deserialize payload. Is the byte array a result of corresponding serialization for DefaultDeserializer?; nested exception is java.io.InvalidClassException: org.springframework.security.core.context.SecurityContextImpl; local class incompatible: stream classdesc serialVersionUID = 550, local class serialVersionUID = 560
As a result, users are logged out. Is there any way to avoid this when updating versions?