spring-projects / spring-projects/spring-session
Unable to pass Integer to @EnableJdbcHttpSession from properties file
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.9k
- Forks
- 1.2k
- Avg merge
- 4h 27m
- Merged PRs (30d)
- 55
Description
Hello,
Trying to control spring-session maxInactiveIntervalInSeconds parameter from application.yml. It wants integer, but string comes from application.yml file. This is needed because we use four session tables in our case.
Part of our project are two portals: one for admins and superusers, another for users. These two as well as all other modules of the project use a single database (Postgres), where also spring-session tables are located. Each portal has it's own pair of spring-session tables. This separation was needed because usernames are unique only within one portal.
Using SpringBoot 1.5.8, Spring-Session 2.0.3
Stackoverflow issue
Here is configuration for Admin module. It is the same as for another module.
@Autowired
public SecurityConfiguration(AdminUserDetailsService userDetailsService,
AdminLoginAuthenticationProvider authenticationProvider,
AuthenticationFailureHandler authenticationFailureHandler,
AuthenticationSuccessHandler authenticationSuccessHandler,
LogoutSuccessHandler logoutSuccessHandler,
AuthenticationEntryPoint authenticationEntryPoint,
FindByIndexNameSessionRepository sessionRepository) {
this.userDetailsService = userDetailsService;
this.authenticationProvider = authenticationProvider;
this.authenticationEntryPoint = authenticationEntryPoint;
this.authenticationFailureHandler = authenticationFailureHandler;
this.authenticationSuccessHandler = authenticationSuccessHandler;
this.logoutSuccessHandler = logoutSuccessHandler;
this.csrfTokenRepository = csrfTokenRepository();
this.sessionRepository = sessionRepository;
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.formLogin()
.loginProcessingUrl("/authenticate")
.usernameParameter("username")
.passwordParameter("password")
.loginPage("/").permitAll()
.successHandler(authenticationSuccessHandler)
.failureHandler(authenticationFailureHandler);
http.logout().permitAll()
.logoutSuccessHandler(logoutSuccessHandler)
.deleteCookies(XSRF_TOKEN, SESSION);
http.authorizeRequests()
.antMatchers("/index.html", "/home.html", "/login.html", ....)
.permitAll().anyRequest().authenticated();
http.sessionManagement()
.maximumSessions(-1)
.sessionRegistry(sessionRegistry());
http.csrf().csrfTokenRepository(csrfTokenRepository);
http.addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);
http.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint);
}
private Filter csrfHeaderFilter() {
return new OncePerRequestFilter() {
@Override
protected void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response, final FilterChain filterChain) throws ServletException, IOException {
//XSRF cookie filter, just puts a cookie inside every request if it does not have any
}
filterChain.doFilter(request, response);
}
};
}
public LazyCsrfTokenRepository csrfTokenRepository() {
final HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
repository.setHeaderName(X_XSRF_TOKEN);
return new LazyCsrfTokenRepository(repository);
}
@Autowired
public void configure(final AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder());
auth.authenticationProvider(authenticationProvider);
}
@Bean
public SpringSessionBackedSessionRegistry sessionRegistry() {
return new SpringSessionBackedSessionRegistry(this.sessionRepository);
}
@Bean
public PasswordEncoder encoder() {
return new BCryptPasswordEncoder();
}
Below is HttpSessionConfig class. It is the same for both, except JdbcTemplate and table name. Used just because we need separate session tables for each module in a single database.
@Lazy
@Configuration
@EnableJdbcHttpSession(tableName = "${admin.portal.spring.session.jdbc.table-name}", maxInactiveIntervalInSeconds = 900)
public class HttpSessionConfig {
@Bean
public JdbcTemplate jdbcTemplate(DataSource dataSource) {
return new JdbcTemplate(dataSource);
}
}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the @EnableJdbcHttpSession annotation in the HttpSessionConfig class and compare its maxInactiveIntervalInSeconds attribute with the application.yml property shown in the issue. Check how the annotation handles property placeholders, then verify that an integer value can be supplied from configuration while preserving the existing table-name setup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, postgresql, spring
- Domain
- backend, databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100