spring-projects / spring-projects/spring-session
Is Spring Session backward compatible?
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.9k
- Forks
- 1.2k
- Avg merge
- 4h 27m
- Merged PRs (30d)
- 55
Description
Hi. let me explain what i'm facing. In a Microservice project we have some services created by spring boot 1.5.x and one project is being developed by spring boot 2.1.x. in this project session sharing is being used by spring session and redis. when we login into this microservice project a session is being created into redis and SecurityContextImpl object is being put in session. service that does this is in spring boot 1.5.x. when we request any rest from services with spring boot 1.5.x there is no problem but when we request a rest from service with spring boot 2.1.x we get 401 status code. after investigating i saw that when we send a request with our gateway to services Session cookie is there and has a valid session id but project with spring boot 2 does not do anything in order to retrieve session from redis and set it. i really don't know that this problem should be asked in Spring Security or here but because i saw no session is being retrieved i posted this issue here.
what i did to see if session is being set is a filter.
public class SessionObservationFilter extends GenericFilterBean {
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
System.out.println("SessionObservationFilter: Starting Execution.");
ResettableRequestWrapper request = new ResettableRequestWrapper((HttpServletRequest) servletRequest);
HttpSession session = request.getSession(false);
if (session != null) {
SecurityContextImpl sci = (SecurityContextImpl) session.getAttribute("SPRING_SECURITY_CONTEXT");
if (sci != null) {
User user = (User) sci.getAuthentication().getPrincipal();
if (user != null) {
System.out.println("Principal Existed On session with id: " + session.getId());
} else {
System.out.println("No Principal exists on session with id: " + session.getId());
}
} else {
System.out.println("No SecurityContextImpl exists for session with id: " + session.getId());
}
} else {
System.out.println("No Session Exist for request: " + request.getRequestURL());
}
System.out.println("SessionObservationFilter: Execution Ended.");
filterChain.doFilter(servletRequest, servletResponse);
}
}
i made sure this filter is being executed after spring session filters. what i always get for requesting rests from service with spring boot 2 is something like No Session Exist for request: localhost:433/app/whatever.
My question: is spring session 2 able to read what spring session 1 writes in redis? is this rises because spring session 1 is writing into redis and spring session 2 can not read that? or this happens because something in spring security does not go well?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the mixed Spring Boot 1.5.x and 2.1.x setup described, using the SessionObservationFilter and Redis-backed session data. Compare how Spring Session 1 and 2 retrieve and deserialize the session and SecurityContext, then document whether the versions interoperate or identify the configuration or compatibility gap.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, redis, spring
- Domain
- authentication, backend, database
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100