Spring-session: After upgrade to Spring Boot 2.0.0.RELEASE , spring session doesn't work.

[jayzch]

Spring session doesn't override servlet container Filter on the first.

on brower,

but in my code, seesionid 63989217-c32a-49b6-93e2-f503b509713d
It doesn't match directly。

@ResponseBody
@RequestMapping(value = "/s")
public String indexs(HttpServletRequest req,HttpServletResponse response) {
    HttpSession session = req.getSession();
    System.out.println(req.getSession().getId());
    return "";
}

[vpavic]

Thanks for the report @jayzch.

Can you provide more information about your configuration? At minimum, Spring Session version and related configuration. Ideally, a minimal, complete, and verifiable example that we can use to reproduce the problem.

[jayzch]

[INFO] +- org.springframework.session:spring-session-data-redis:jar:2.0.2.RELEASE:compile
[INFO] | +- org.springframework.data:spring-data-redis:jar:2.0.5.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-starter-web:jar:2.0.0.RELEASE:compile

spring.session.store-type=redis
spring.redis.host=redis.localdomain

[vpavic]

Aha, so the problem you're reporting is that the value of the wechat_sessionid cookie your client is sending with the request is different from sessionId you're seeing on server side?

As of 2.0, Spring Session uses Base64 encoded session cookies by default (see #736). If you don't want to use Base64 encoded cookie you need to configure your own DefaultCookieSerializer and set useBase64Encoding to false.

[jayzch]

<bean id="cookieSerializer" class="org.springframework.session.web.http.DefaultCookieSerializer">
    <property name="cookieName" value="wechat_sessionid"/>
    <property name="useBase64Encoding" value="false"/>

</bean>

[jayzch]

Thanks for your help. @vpavic
I think req.getSession().getId() should be encoded by Base64 as well.

[vpavic]

No, it shouldn't. This is a cookie serialization related concern, not session id generation one.

[sanjayagnani92]

@vpavic Do we have any Spring boot application property to enable/disable base64 encoding for cookie value from application .properties?

[vpavic]

@sanjayagnani92 No, there isn't one. You need to register your own DefaultCookieSerializer bean and configure it according to your needs.

[vpavic]

Closing as answered. If you have additional questions or feel that your original question isn't properly answered, please re-open the issue.

[jayzch]

in application .properties

server.servlet.session.cookie.max-age=518400
server.servlet.session.cookie.name= wechat_sessionid

in main boot class
@EnableRedisHttpSession

Does it work for Spring Session to set expiration time and cookie name?

[vpavic]

Spring Boot allows you to configure SessionCookieConfig via configuration properties. Some CookieSerializer options are covered by this, however Base64 serialization option is not.

BTW I'm curious why you can't simply stick with Base64 encoded session cookie?

[jayzch]

I do not care about session cookie encoded Base64 whether or not.But req.getSession().getId() should return the same value as we expect, otherwise it's confusing.

[vpavic]

Can you explain what is the value that you expect? It seems to me that you care about cookie value, and not session id. Those things are not the same.

[jayzch]

Every now and then , session id is used at the business process. Although it may not be best practice.

[vpavic]

Using session id is perfectly fine. However, you shouldn't assume that the raw value of session cookie matches the raw value of session id, or for that matter, that the session cookie value only contains session id. Relying on that is somewhat fragile. That's why you should be mindful of serialization concerns.

[pcornelissen]

So, a common usecase for microservices is to make calls on behalf of the user. Prior 2.x I added the session "by hand" to the resttemplate requests.

Now I have to do the base64 encoding myself, why is there no reasy way to pass this along in resttemplate calls or at least get the cookie string that I can pass along?

As far as I have seen, I can't simply do that without knowing which format is used by spring. The CookieSerializer is only aimed for direct request/response modifications.

Am I not seeing the correct way or is there none yet?

[vpavic]

@pcornelissen Since this issue is closed, and you've created #1109 shortly after commenting here, let's take further discussion over there.