[17:47:06.124] WARN [nConfigServletWebServerApplicationContext] Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.support.BeanDefinitionOverrideException: Invalid bean definition with name 'sessionRepository' defined in class path resource [com/orange/ccmd/spring/redis/SessionConfig.class]: Cannot register bean definition [Root bean: class [null]; scope=; abstract=false; lazyInit=false; autowireMode=3; dependencyCheck=0; autowireCandidate=true; primary=true; factoryBeanName=sessionConfig; factoryMethodName=sessionRepository; initMethodName=null; destroyMethodName=(inferred); defined in class path resource [com/orange/ccmd/spring/redis/SessionConfig.class]] for bean 'sessionRepository': There is already [Root bean: class [null]; scope=; abstract=false; lazyInit=false; autowireMode=3; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration; factoryMethodName=sessionRepository; initMethodName=null; destroyMethodName=(inferred); defined in class path resource [org/springframework/session/data/redis/config/annotation/web/http/RedisHttpSessionConfiguration.class]] bound.
and my config class
@EnableRedisHttpSession
public class SessionConfig extends AbstractHttpSessionApplicationInitializer {
@Bean
@Primary
public SessionRepository sessionRepository() {
return new InitialRedisDynoSessionRepository();
}
}but I use spring-boot in my app. May be it is not the right way to do so ?
@Primary is not enough from version 2.1.0+. You’ll also need to allow bean definition overriding. See https://github.com/spring-projects/spring-boot/issues/13609#issuecomment-435485946
@oharsta Ok, I see but my problem (may be I am wrong) but my custom class is not the same type as the standard class (plead find below the 2 signatures).
I get an exception, quite clear I guess. If I am doing an override method of the bean, I have to have the same type.
[21:10:27.047] WARN [nConfigServletWebServerApplicationContext] Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'redisMessageListenerContainer' defined in class path resource [org/springframework/session/data/redis/config/annotation/web/http/RedisHttpSessionConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.data.redis.listener.RedisMessageListenerContainer]: Factory method 'redisMessageListenerContainer' threw exception; nested exception is java.lang.IllegalStateException: @Bean method RedisHttpSessionConfiguration.sessionRepository called as bean reference for type [org.springframework.session.data.redis.RedisOperationsSessionRepository] but overridden by non-compatible bean instance of type [com.orange.ccmd.spring.redis.RedisDynoSessionRepository]. Overriding bean of same name declared in: class path resource [com/orange/ccmd/spring/redis/SessionConfig.class]This is my custom class signature :
public class RedisDynoSessionRepository implements
FindByIndexNameSessionRepository<RedisDynoSessionRepository.RedisSession>And this is the standard Class :
public class RedisOperationsSessionRepository implements
FindByIndexNameSessionRepository<RedisOperationsSessionRepository.RedisSession>,
MessageListenerIt implements the MessageListener but as I don’t want to do messaging in my custom class I don’t implement this interface.
@EnableSpringHttpSessionannotation to register my custom bean instead of the @EnableRedisHttpSession.
If you run the app and go to /index.html, you see that modifications to the fields do not persist into the session. But with the spring-session-hazelcast dependency removed, the app works. Any ideas what I might be missing?
Hi everyone.
I am not sure If I am right here, but I found an "incompatibility between default values" for the reactive spring-webflux and the non-reactive servlet based session handling.
It is based in the CookieHttpSessionIdResolver respectively in CookieWebSessionIdResolver.
By default, the Servlet-based strategy is base64-encoding the session id for the cookie value, the reactive solution does not (and seems not to have an option to activate such a behavior as far I can see).
So in an heterogenous microservice environment with servlet- and webflux-based microservices, a setup using the default values, will not work. So for example:
auth-service creates the cookie (base64 encoded, because it is a servlet-based application), and another microservice (a spring-cloud-gateway API gateway for example) would fail to find the session because it tries to find the base64 encoded value in the database.
So my questions:
- Is this "working as intended"?
- Wouldn't it be better to make the default behavior the same "in both worlds" by implementing Base64 encoding/decoding in
CookieWebSessionIdResolverby default too?
Hi all,
I need help with the next case:
https://gist.github.com/SteelAlex/ac129a8099c9518e50f6815b3c2bfe1f - I configured Spring Security + Spring Session. I use custom header for session. And I can't change session timeout, I always logout after default 15 minutes of inactivity. I tried to set spring.session.timeout and/or server.servlet.session.timeout, but it doesn't work.
I am sure I am doing something wrong, but I have no ideas what.
Imagine the old fashion servlet API where you had a "thing" attached your connection to the servlet that you could store information, like a shopping cart. In the olden days, we had sticky servers so a given browser would be sent back to the same server, and they could then tap that bucket of shopping cart data.
If you didn't guess, this doesn't scale. If you're running 10,000 servers in the cloud, forcing existing browsers back to the same node is asking for trouble. So what do you do?
Solution: move this bucket of information that is specific to a given user in their browser into a 3rd party data store, like a JDBC store. That's what Rob Winch basically did. He coded a solution that implemented the servlet spec's session API, and delegated to pushing the information off the server and into a remote server.
Now, the browser doesn't have to go back to the same server every single time. Instead, with a cookie in hand, you can go to ANY node, present your cookie, and Spring Session will retrieve the shopping cart, and repopulate your current request's instance with the details.
With this clear break between servlet HttpSession and 3rd party data store, it became easy to implement alternatives like Redis, Hazelcast, Geode, and MongoDB.
But it still boils down to essentially a Map provided to the servlet to store/retrieve session-specific data, but with a much more scalable, cloud friendly, performant solution.
Hi everyone. I’m using Spring Session Hazelcast in my stack. The ecosystem is composed by several microservices that are all connected as nodes on Hazelcast.
I’m facing an issue when trying to use those services with different versions of Spring Security. I basically get this error when I try do deserialize the session:
java.io.InvalidClassException: org.springframework.security.core.context.SecurityContextImpl; local class incompatible: stream classdesc serialVersionUID = 420, local class serialVersionUID = 520
MapSession object from Hazelcast, since this object contains Spring Security specific classes. But by the way Spring Session works, it seems to me that what goes into MapSession is out of our control (except for the Principal part)