Last access time should never decrease

[2is10]

If a request takes a long time to service, such as a long-polling request or SSE (Server-Sent Events) request, SessionRepositoryFilter can update the session's last-access time with a very stale value, possibly longer even than the max-inactive interval. This would effectively expire the session.

A simple fix for the JDBC repository might be to change the update query to use LAST_ACCESS_TIME = max(LAST_ACCESS_TIME, ?).

I’m using 2.0.8. Problem also exists in master.

[vpavic]

Thanks for the report @2is10. I see your point - we need to look into this for each SessionRepository implementation. At the moment I'm not sure we can handle this in Spring Session core.