Spring session (redis) - Add support for using redis serializers for keys in RedisOperationsSessionRepository

I'm using Spring session 1.1.1 release and storing my sessions in redis. We wanted to change the way session data is stored in redis this is due to the fact all session details are stored in redis in the clear. This makes it open for any security breach. We wanted it to be encrypted and hence I did following changes to supply a custom serializer to spring redis session.

@Autowired
@Qualifier("sessionRedisTemplate")
private RedisTemplate<Object, Object> redisTemplate;

@PostConstruct
public void postConstruct() {
	/* 
	 * genericRedisSerializer & stringRedisSerializers are custom implementations
	 * that encrypts contents before putting it in redis (both keys and values)
	 */
	redisTemplate.setKeySerializer(genericRedisSerializer);
	redisTemplate.setHashKeySerializer(genericRedisSerializer);
	redisTemplate.setDefaultSerializer(genericRedisSerializer);
	redisTemplate.setHashValueSerializer(genericRedisSerializer);
	redisTemplate.setValueSerializer(genericRedisSerializer);
	redisTemplate.setStringSerializer(stringRedisSerializer);
}

This works well but leaves behind a list of indexes that aren't cleared (spring:session:index:org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME:username). Overtime this gets really large enough for us to run through scripts in redis to clear them.

Upon further investigation we found that Redis keyspace notification handler in RedisOperationsSessionRepository doesn't perform deserialization of the keys before retrieving it from the message. This fails the asynchronous process and hence leading to these indexes to live forever.

Start in RedisOperationsSessionRepository, focusing on its Redis keyspace notification handler and how keys are retrieved from messages. Verify how custom key serializers affect deserialization, then ensure the affected session indexes are cleared correctly when notifications are processed.