spring-projects / spring-projects/spring-session

Redis Spring Session - Indexes have a TTL of No Limit

Open
#3,183 2 comments 7 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: bug
Dominant language
Java
Stars
1.9k
Forks
1.2k
Avg merge
4h 27m
Merged PRs (30d)
55

Description

The issue I am encountering relates to the fact that while Spring Session / Security is saving my session data to Redis and applying a TTL (Time-To-Live) to the main session keys, the associated indexed keys (such as attributes indexed for lookups) are not automatically being set with a TTL. This means that these indexed keys can persist indefinitely unless manually deleted (e.g., through an explicit logout), leading to a potential memory leak.

Is there a way, and if not, can I request the ability to attach time limits to indexed components of sessions (e.g. in Redis). The normal session keys get cleaned up by Redis as they have a TTL, but as you can see below, when a session naturally expires, the other bits remain in Redis.

Is it right behaviour for when sessions expire and get removed for the Indexed keys to remain their indefinitely?

Screenshot 2024-09-01 at 10 09 59

These should be removed by Redis based on a TTL assigned to them, just like with the hashed session key - or some cron function should be provided,

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior.

Expected behavior
A clear and concise description of what you expected to happen.

Sample

A link to a GitHub repository with a minimal, reproducible sample.

Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source files or tests are named. Start by reproducing natural session expiry in Redis and inspect the indexed keys after the main session key is removed; done means indexed session data is also cleaned up automatically through TTLs or an explicitly supported cleanup mechanism.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, redis, spring
Domain
backend, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.