spring-projects / spring-projects/spring-session
Redis Spring Session - Indexes have a TTL of No Limit
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.9k
- Forks
- 1.2k
- Avg merge
- 4h 27m
- Merged PRs (30d)
- 55
Description
The issue I am encountering relates to the fact that while Spring Session / Security is saving my session data to Redis and applying a TTL (Time-To-Live) to the main session keys, the associated indexed keys (such as attributes indexed for lookups) are not automatically being set with a TTL. This means that these indexed keys can persist indefinitely unless manually deleted (e.g., through an explicit logout), leading to a potential memory leak.
Is there a way, and if not, can I request the ability to attach time limits to indexed components of sessions (e.g. in Redis). The normal session keys get cleaned up by Redis as they have a TTL, but as you can see below, when a session naturally expires, the other bits remain in Redis.
Is it right behaviour for when sessions expire and get removed for the Indexed keys to remain their indefinitely?
These should be removed by Redis based on a TTL assigned to them, just like with the hashed session key - or some cron function should be provided,
Describe the bug
A clear and concise description of what the bug is.
To Reproduce
Steps to reproduce the behavior.
Expected behavior
A clear and concise description of what you expected to happen.
Sample
A link to a GitHub repository with a minimal, reproducible sample.
Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source files or tests are named. Start by reproducing natural session expiry in Redis and inspect the indexed keys after the main session key is removed; done means indexed session data is also cleaned up automatically through TTLs or an explicitly supported cleanup mechanism.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, redis, spring
- Domain
- backend, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100