spring-projects / spring-projects/spring-session

Unable to pass Integer to @EnableJdbcHttpSession from properties file

Open
#1,156 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage
Dominant language
Java
Stars
1.9k
Forks
1.2k
Avg merge
4h 27m
Merged PRs (30d)
55

Description

Hello,
Trying to control spring-session maxInactiveIntervalInSeconds parameter from application.yml. It wants integer, but string comes from application.yml file. This is needed because we use four session tables in our case.
Part of our project are two portals: one for admins and superusers, another for users. These two as well as all other modules of the project use a single database (Postgres), where also spring-session tables are located. Each portal has it's own pair of spring-session tables. This separation was needed because usernames are unique only within one portal.
Using SpringBoot 1.5.8, Spring-Session 2.0.3
Stackoverflow issue

Here is configuration for Admin module. It is the same as for another module.

@Autowired
public SecurityConfiguration(AdminUserDetailsService userDetailsService,
                             AdminLoginAuthenticationProvider authenticationProvider,
                             AuthenticationFailureHandler authenticationFailureHandler,
                             AuthenticationSuccessHandler authenticationSuccessHandler,
                             LogoutSuccessHandler logoutSuccessHandler,
                             AuthenticationEntryPoint authenticationEntryPoint,
                             FindByIndexNameSessionRepository sessionRepository) {
    this.userDetailsService = userDetailsService;
    this.authenticationProvider = authenticationProvider;
    this.authenticationEntryPoint = authenticationEntryPoint;
    this.authenticationFailureHandler = authenticationFailureHandler;
    this.authenticationSuccessHandler = authenticationSuccessHandler;
    this.logoutSuccessHandler = logoutSuccessHandler;
    this.csrfTokenRepository = csrfTokenRepository();
    this.sessionRepository = sessionRepository;
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.formLogin()
            .loginProcessingUrl("/authenticate")
            .usernameParameter("username")
            .passwordParameter("password")
            .loginPage("/").permitAll()
            .successHandler(authenticationSuccessHandler)
            .failureHandler(authenticationFailureHandler);

    http.logout().permitAll()
            .logoutSuccessHandler(logoutSuccessHandler)
            .deleteCookies(XSRF_TOKEN, SESSION);

    http.authorizeRequests()
            .antMatchers("/index.html", "/home.html", "/login.html", ....)
            .permitAll().anyRequest().authenticated();

    http.sessionManagement()
            .maximumSessions(-1)
            .sessionRegistry(sessionRegistry());

    http.csrf().csrfTokenRepository(csrfTokenRepository);
    http.addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);
    http.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint);
}

 private Filter csrfHeaderFilter() {
    return new OncePerRequestFilter() {
        @Override
        protected void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response, final FilterChain filterChain) throws ServletException, IOException {
            //XSRF cookie filter, just puts a cookie inside every request if it does not have any
            }
            filterChain.doFilter(request, response);
        }
    };
}

public LazyCsrfTokenRepository csrfTokenRepository() {
    final HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
    repository.setHeaderName(X_XSRF_TOKEN);
    return new LazyCsrfTokenRepository(repository);
}

@Autowired
public void configure(final AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder());
    auth.authenticationProvider(authenticationProvider);
}

@Bean
public SpringSessionBackedSessionRegistry sessionRegistry() {
    return new SpringSessionBackedSessionRegistry(this.sessionRepository);
}

@Bean
public PasswordEncoder encoder() {
    return new BCryptPasswordEncoder();
}

Below is HttpSessionConfig class. It is the same for both, except JdbcTemplate and table name. Used just because we need separate session tables for each module in a single database.

@Lazy
@Configuration
@EnableJdbcHttpSession(tableName = "${admin.portal.spring.session.jdbc.table-name}",     maxInactiveIntervalInSeconds = 900)
public class HttpSessionConfig {

@Bean
public JdbcTemplate jdbcTemplate(DataSource dataSource) {
    return new JdbcTemplate(dataSource);
}
}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the @EnableJdbcHttpSession annotation in the HttpSessionConfig class and compare its maxInactiveIntervalInSeconds attribute with the application.yml property shown in the issue. Check how the annotation handles property placeholders, then verify that an integer value can be supplied from configuration while preserving the existing table-name setup.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, postgresql, spring
Domain
backend, databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.