I have seen similar posts but with no clear answer: https://github.com/spring-projects/spring-session/issues/1017, https://github.com/spring-projects/spring-session/issues/1103
on our environment whenever we create a session the commands that are executed on our redis are the below:
1589154520.098715 [0 127.0.0.1:35190] "HMSET" "spring:session:player-api:service:sessions:ca14663d-f49d-481f-aebd-61e1722eb4df" "lastAccessedTime" "\xac\xed\x00\x05sr\x00\x0ejava.lang.Long;\x8b\xe4\x90\xcc\x8f#\xdf\x02\x00\x01J\x00\x05valuexr\x00\x10java.lang.Number\x86\xac\x95\x1d\x0b\x94\xe0\x8b\x02\x00\x00xp\x00\x00\x01r\x00\xfd\x9c\"" "maxInactiveInterval" "\xac\xed\x00\x05sr\x00\x11java.lang.Integer\x12\xe2\xa0\xa4\xf7\x81\x878\x02\x00\x01I\x00\x05valuexr\x00\x10java.lang.Number\x86\xac\x95\x1d\x0b\x94\xe0\x8b\x02\x00\x00xp\x00\x00\a\b" "creationTime" "\xac\xed\x00\x05sr\x00\x0ejava.lang.Long;\x8b\xe4\x90\xcc\x8f#\xdf\x02\x00\x01J\x00\x05valuexr\x00\x10java.lang.Number\x86\xac\x95\x1d\x0b\x94\xe0\x8b\x02\x00\x00xp\x00\x00\x01r\x00\xfd\x9c\"" "sessionAttr:SPRING_SECURITY_CONTEXT" "\xac\xed\x00\x05sr\x00=org.springframework.security.core.context.SecurityContextImpl\x00\x00\x00\x00\x00\x00\x01\xa4\x02\x00\x01L\x00\x0eauthenticationt\x002Lorg/springframework/security/core/Authentication;xpsr\x00Pcom.openbet.api.player.security.shared.authentication.OpenbetAuthenticationToken\xfb\x0c\xde\xad]cL\xcf\x02\x00\x02L\x00\x0bcredentialst\x00\x12Ljava/lang/Object;L\x00\tprincipalq\x00~\x00\x04xr\x00Gorg.springframework.security.authentication.AbstractAuthenticationToken\xd3\xaa(~nGd\x0e\x02\x00\x03Z\x00\rauthenticatedL\x00\x0bauthoritiest\x00\x16Ljava/util/Collection;L\x00\adetailsq\x00~\x00\x04xp\x01sr\x00&java.util.Collections$UnmodifiableList\xfc\x0f%1\xb5\xec\x8e\x10\x02\x00\x01L\x00\x04listt\x00\x10Ljava/util/List;xr\x00,java.util.Collections$UnmodifiableCollection\x19B\x00\x80\xcb^\xf7\x1e\x02\x00\x01L\x00\x01cq\x00~\x00\x06xpsr\x00\x13java.util.ArrayListx\x81\xd2\x1d\x99\xc7a\x9d\x03\x00\x01I\x00\x04sizexp\x00\x00\x00\x00w\x04\x00\x00\x00\x00xq\x00~\x00\rpt\x00\x00t\x00\ranonymousUser"
1589154520.099238 [0 127.0.0.1:35190] "SADD" "spring:session:player-api:service:index:org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME:anonymousUser" "\xac\xed\x00\x05t\x00$ca14663d-f49d-481f-aebd-61e1722eb4df"
1589154520.099801 [0 127.0.0.1:35190] "APPEND" "spring:session:player-api:service:sessions:expires:ca14663d-f49d-481f-aebd-61e1722eb4df" ""
1589154520.100706 [0 127.0.0.1:35190] "PEXPIRE" "spring:session:player-api:service:sessions:expires:ca14663d-f49d-481f-aebd-61e1722eb4df" "1800000"
1589154520.100908 [0 127.0.0.1:35190] "PEXPIRE" "spring:session:player-api:service:sessions:ca14663d-f49d-481f-aebd-61e1722eb4df" "2100000"
Issue 1: First of all we noticed that through our health checks spring is creating sessions for anonymous users. Is there a way to prevent redis to create sessions for anonymous users?
Issue 2: Second we see that for all users redis is creating a key with no expiration time:
127.0.0.1:6380> ttl "spring:session:player-api:service:index:org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME:4759e891-8d67-4a32-9df2-654e192fd78e"
(integer) -1
According to here: https://docs.spring.io/spring-session/docs/1.3.0.RELEASE/reference/html5/#api-redisoperationssessionrepository-storage :
"SADD" "spring:session:player-api:service:index:org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME:anonymousUser" "\xac\xed\x00\x05t\x00$ca14663d-f49d-481f-aebd-61e1722eb4df"
no similar sadd command is executed.
For our logged in users when they logged out then all related keys are deleted from redis. But when waiting for session to timeout , the keys with no expiration time are not deleted
Why this key is created? Why it has no expiration time? and how/when redis finally deletes it?Cause according to the cleanup cron job the keys are deleted according to expiration time.
Thanks in advance, Lena