spring-projects / spring-projects/spring-session
DefaultCookieSerializer sets the jvmRoute for the Cookie but not the HttpSession identifier
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.9k
- Forks
- 1.2k
- Avg merge
- 4h 27m
- Merged PRs (30d)
- 55
Description
I have implemented Spring Session with Redis on my legacy application as per the docs and it works very well for loadbalancing and preventing users from being kicked out during downtime of one of my Java nodes.
I implemented the Default cookie serializer as per this link https://docs.spring.io/spring-session/docs/current/reference/html5/guides/java-custom-cookie.html because I wanted to have the jvmRoute added to the Session identifier.
This does provide some server affinity, however my application uses Talend to create sqlite dbs for some reporting and we pass the session id to Talend, so that it may call my application again, but since the sqlite db's are created locally, it needs to make sure those calls go to the same server.
The issue we have is that the jvmRoute is set in the cookie in the ServletRequest and Response, but the actual session information (HttpSession) that we store in Redis does not have the jvmRoute so I only see the hex session Id.
Tomcat used to keep the jvmRoute in the SessionID which allowed our application to work.
I realize that I can determine the JvmRoute in the code, but unfortunately, the sessionId is sometimes a substring of the unique id passed to talend, this is resulting in a lot of messy code change that I would prefer to not have to deal with
It would be really useful if we could preserve this suffix in the HttpSession identifier.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with DefaultCookieSerializer and the linked Spring Session custom-cookie guide, then trace how the cookie identifier differs from the HttpSession identifier stored in Redis. Check the interaction with Tomcat's jvmRoute behavior and determine whether the suffix should be preserved in the stored session identifier; done means the HttpSession identifier exposes the jvmRoute suffix consistently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, redis, spring, sqlite
- Domain
- backend, distributed-systems
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100