I am using Redis as session storage (running in docker container) for my Spring Boot application (2.1.7). In application.properties are these records:
spring.session.store-type=redis
server.servlet.session.timeout=7d
spring.session.redis.flush-mode=on_save
spring.session.redis.namespace=spring:session
spring.redis.host=localhost
spring.redis.port=6379
server.servlet.session.cookie.secure=true
server.servlet.session.cookie.http-only=true
The Redis is "working". So there is functional session storage.
But the problem is that session expiry time on cookie is like this:

And If I close the browser and reopen the tab, I am not logged (and I have a new session identifier). And it does not take effeck if I am logged as user, logged as admin (there is some listener listed below handling expiry time differently) or as guest (not logged user). Every time I restart browser, I have a new session identifier.
The usual "TTL" for session is 7 days (as describer in property file), but for admin users there is time redured to 1 hour
if (authentication.getPrincipal() instanceof LoggedInPersonDetails) {
LoggedInPersonDetails loggedInPersonDetails = (LoggedInPersonDetails) authentication.getPrincipal();
loggedInPersonDetails.getAuthorities().stream()
.filter(authority -> !Authority.WEB_ENTER.getName().equals(authority.getAuthority()))
.findAny()
.ifPresent(authority ->
session.setMaxInactiveInterval((int) nonStandardUserSessionTimeout.getSeconds()));
}
Dependencies in pom.xml
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.session</groupId>
<artifactId>spring-session-data-redis</artifactId>
</dependency>
<dependency>
<groupId>redis.clients</groupId>
<artifactId>jedis</artifactId>
</dependency>
None of this seems to be working. I switched from "classic" (non redis) spring boot session handling where behav was as expected. So there must be some error in spring boot to redis configuration.
EDIT: I tried to add the
server.servlet.session.cookie.max-age=7d
property but it does not seem to work. Expiry on cookie is still set to Session
EDIT2: I´ve figured out how to set expiration of cookie, I´ve registerd DefaultCookieSerializer bean in my Mvc config and set maxAge property to some value.
@Bean
public CookieSerializer defaultCookieSerializer() {
DefaultCookieSerializer serializer = new DefaultCookieSerializer();
serializer.setCookieMaxAge(60 * 60 * 24 * 7);
return serializer;
}
But a new problem occures. The cookie expiry date is not updated as I am active on web. For example when expiry date is set to 12:00 and I reload the page at 11:58, the cookie expiry date should be renewed to now() + default maxAge.
I found some solution about implementing custom interceptor but that does not seem like a right solution to me. The spring-session has really not some functionality to do this?