$ show spring-projects/spring-session
Spring Session is a library that provides a robust, pluggable session management solution for Spring-based applications. It abstracts session storage behind a `SessionRepository` interface, supporting multiple backends including Redis, JDBC, and in-memory. The library seamlessly integrates with both Servlet and WebFlux stacks, replacing the standard `HttpSession` with a configurable, cluster-friendly alternative. It also offers deep integration with Spring Security for concurrent session control and remember-me authentication, and with WebSocket for session-aware messaging. The architecture is modular: `spring-session-core` defines the core API (Session, SessionRepository, FindByIndexNameSessionRepository, HttpSessionIdResolver) and provides the servlet filter (`SessionRepositoryFilter`) and reactive store (`SpringSessionWebSessionStore`). `spring-session-data-redis` implements Redis-backed repositories with support for indexing by principal name and expiration via sorted sets and keyspace notifications. `spring-session-jdbc` provides a JDBC-backed repository with dialect-specific SQL schemas and customizable queries. Configuration is annotation-driven (e.g., `@EnableRedisHttpSession`, `@EnableJdbcHttpSession`) and supports customization through beans like `CookieSerializer`, `SessionRepositoryCustomizer`, and `FlushMode`/`SaveMode`. Key data flows involve session creation, attribute modification, expiration, and principal-based lookup. The library uses events (`SessionCreatedEvent`, `SessionDeletedEvent`, `SessionExpiredEvent`) for lifecycle notifications and supports AOT compilation for GraalVM native images. External dependencies include Spring Framework, Spring Data Redis, Spring Data JDBC, Reactor, and optionally Jackson for JSON serialization. The build system uses Gradle with custom convention plugins for publishing, documentation, and release management.
The LLM identified 5 files worth highlighting for reuse:
A fully configurable cookie serializer that handles reading and writing session cookies. Supports custom cookie name, domain, path, SameSite attribute, Partitioned, Base64 encoding, JVM route, and remember-me. It is self-contained, implements the `CookieSerializer` interface, and can be extracted and reused in any Spring-based project requiring custom cookie handling.
A `HttpServletResponseWrapper` that intercepts response commit (flushBuffer, sendError, sendRedirect) to trigger session saving before the response is sent. It uses a `OnCommittedResponseWrapper` pattern to ensure session persistence in a non-invasive way. This component is reusable for any scenario requiring pre-commit actions on the response.
Implements session expiration tracking in Redis using a sorted set (`expirations`) and separate `expires:` keys. It rounds expiration times to the nearest minute for efficient cleanup and uses a background task to remove expired sessions. This pattern is reusable for any Redis-based expiration management and demonstrates non-obvious use of Redis sorted sets for time-based indexing.
An `IndexResolver` implementation that extracts the principal name from a session using Spring Security's `SecurityContext` or a custom SpEL expression. It supports both imperative and reactive repositories and can be easily extended for custom indexing strategies. This component is self-contained and demonstrates a clean separation of concerns for session indexing.
A composite `HttpSessionIdResolver` that delegates to multiple resolvers (e.g., cookie and header) in order. It allows combining different session ID resolution strategies without modifying existing resolvers. This is a textbook implementation of the Composite pattern and is reusable for any multi-strategy resolution scenario.