spring-projects / spring-projects/spring-session

RedisIndexedSessionRepository: PRINCIPAL_NAME_INDEX_NAME index not cleaned up when applications use key namespace/prefix

Open
#3,334 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: bug
Dominant language
Java
Stars
1.9k
Forks
1.2k
Avg merge
4h 27m
Merged PRs (30d)
55

Description

Describe the bug
We are using RedisIndexedSessionRepository in multiple Spring Boot applications (over 100), all connected to a single Redis cluster. Each application defines a unique namespace (Redis key prefix) and has access only to keys within its own namespace.

However, since Redis publishes key-deleted and key-expired events on general channels (without a namespace prefix), session removal and expiration events are not routed to the specific application that owns the session. Instead, these events are randomly consumed by any application connected to the cluster.

As a result:

  • SessionDestroyedEvent and SessionExpiredEvent cannot be reliably used
  • The PRINCIPAL_NAME_INDEX_NAME key is not properly cleaned up, leading to continuous growth over time

Could you provide any recommendations for addressing this issue? Additionally, are there any planned improvements in future versions to mitigate this behavior?

Expected behavior
Session key-deleted and Session key-expired events should be routed to the application owning the session.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing RedisIndexedSessionRepository's handling of key-deleted and key-expired events, with attention to PRINCIPAL_NAME_INDEX_NAME cleanup when applications use distinct key namespaces. Verify how Redis cluster events are delivered across applications and define a test or reproduction showing that session removal and expiration are handled by the owning application and the principal index is cleaned up.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, redis, spring
Domain
backend, databases, distributed-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.