spring-projects / spring-projects/spring-session

Is Spring Session backward compatible?

Open
#1,359 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage
Dominant language
Java
Stars
1.9k
Forks
1.2k
Avg merge
4h 27m
Merged PRs (30d)
55

Description

Hi. let me explain what i'm facing. In a Microservice project we have some services created by spring boot 1.5.x and one project is being developed by spring boot 2.1.x. in this project session sharing is being used by spring session and redis. when we login into this microservice project a session is being created into redis and SecurityContextImpl object is being put in session. service that does this is in spring boot 1.5.x. when we request any rest from services with spring boot 1.5.x there is no problem but when we request a rest from service with spring boot 2.1.x we get 401 status code. after investigating i saw that when we send a request with our gateway to services Session cookie is there and has a valid session id but project with spring boot 2 does not do anything in order to retrieve session from redis and set it. i really don't know that this problem should be asked in Spring Security or here but because i saw no session is being retrieved i posted this issue here.
what i did to see if session is being set is a filter.

public class SessionObservationFilter extends GenericFilterBean {
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        System.out.println("SessionObservationFilter: Starting Execution.");
        ResettableRequestWrapper request = new ResettableRequestWrapper((HttpServletRequest) servletRequest);
        HttpSession session = request.getSession(false);
        if (session != null) {
            SecurityContextImpl sci = (SecurityContextImpl) session.getAttribute("SPRING_SECURITY_CONTEXT");
            if (sci != null) {
                User user = (User) sci.getAuthentication().getPrincipal();
                if (user != null) {
                    System.out.println("Principal Existed On session with id: " + session.getId());
                } else {
                    System.out.println("No Principal exists on session with id: " + session.getId());
                }
            } else {
                System.out.println("No SecurityContextImpl exists for session with id: " + session.getId());
            }
        } else {
            System.out.println("No Session Exist for request: " + request.getRequestURL());
        }
        System.out.println("SessionObservationFilter: Execution Ended.");
        filterChain.doFilter(servletRequest, servletResponse);
    }
}

i made sure this filter is being executed after spring session filters. what i always get for requesting rests from service with spring boot 2 is something like No Session Exist for request: localhost:433/app/whatever.
My question: is spring session 2 able to read what spring session 1 writes in redis? is this rises because spring session 1 is writing into redis and spring session 2 can not read that? or this happens because something in spring security does not go well?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the mixed Spring Boot 1.5.x and 2.1.x setup described, using the SessionObservationFilter and Redis-backed session data. Compare how Spring Session 1 and 2 retrieve and deserialize the session and SecurityContext, then document whether the versions interoperate or identify the configuration or compatibility gap.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, redis, spring
Domain
authentication, backend, database
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.