spring-projects / spring-projects/spring-session

DefaultCookieSerializer sets the jvmRoute for the Cookie but not the HttpSession identifier

Open
#1,165 0 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage
Dominant language
Java
Stars
1.9k
Forks
1.2k
Avg merge
4h 27m
Merged PRs (30d)
55

Description

I have implemented Spring Session with Redis on my legacy application as per the docs and it works very well for loadbalancing and preventing users from being kicked out during downtime of one of my Java nodes.

I implemented the Default cookie serializer as per this link https://docs.spring.io/spring-session/docs/current/reference/html5/guides/java-custom-cookie.html because I wanted to have the jvmRoute added to the Session identifier.

This does provide some server affinity, however my application uses Talend to create sqlite dbs for some reporting and we pass the session id to Talend, so that it may call my application again, but since the sqlite db's are created locally, it needs to make sure those calls go to the same server.

The issue we have is that the jvmRoute is set in the cookie in the ServletRequest and Response, but the actual session information (HttpSession) that we store in Redis does not have the jvmRoute so I only see the hex session Id.

Tomcat used to keep the jvmRoute in the SessionID which allowed our application to work.

I realize that I can determine the JvmRoute in the code, but unfortunately, the sessionId is sometimes a substring of the unique id passed to talend, this is resulting in a lot of messy code change that I would prefer to not have to deal with

It would be really useful if we could preserve this suffix in the HttpSession identifier.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with DefaultCookieSerializer and the linked Spring Session custom-cookie guide, then trace how the cookie identifier differs from the HttpSession identifier stored in Redis. Check the interaction with Tomcat's jvmRoute behavior and determine whether the suffix should be preserved in the stored session identifier; done means the HttpSession identifier exposes the jvmRoute suffix consistently.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, redis, spring, sqlite
Domain
backend, distributed-systems
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.