spring-session

spring-session copied to clipboard

Programmatically Disable CSRF for x-auth-token

2

We should provide a way for Spring Session to programmatically disable Spring Security's CSRF support on requests in which x-auth-token is used for establishing the session. We could perhaps disable...

rwinch

Add the Session to a SessionContextHolder similar to SecurityContextHolder. The SessionContextHolder would store the Session in a ThreadLocal. This will allow users to access the current Session anywhere within their...

rwinch

Create websocket sample tests

1

rwinch

See #838 for background (and more specifically [this comment](https://github.com/spring-projects/spring-session/issues/838#issuecomment-736086339)). The approach with a single SQL statement based session clean-up job has been historically been somewhat problematic, seeing several revisions to...

vpavic

See #1606 for background. There have also been similar inquiries earlier. The reference manual should be more explicit about production considerations for configuring Redis keyspace notifications.

vpavic

Consider providing Micrometer integration

1

We could consider exposing some session related metrics using Micrometer.

vpavic

SessionRepositoryFilter.SessionRepositoryRequestWrapper.commitSession() triggers extraneous call to SessionRespository.findById(...)

4

**Describe the bug** For a valid session, SessionRepositoryFilter.SessionRepositoryRequestWrapper.commitSession() does the following: 1. Clears cached values for references for requestedSessionCache, requestedSession, and requestedSessionId. 1. Saves the state of the session 1....

pferraro

SessionRepositoryFilter's getRequestedSession is called unnecessarily.

10

When Spring Session used in the application was upgraded from **1.3.1.RELEASE** to **2.1.3.RELEASE**, performance was verified and it was confirmed that the CPU utilization has increased by about 10%. When...

hosoitk

GitHub actions 2.4.x CI does not trigger daily build

1

The GitHub Actions CI workflow for 2.4.x is configured to run daily at 10am UTC, but that does not happen. Perhaps it is because GitHub Actions cannot differentiate between the...

eleftherias

[Spring Session Redis] Web session expiration notifications not delayed until application is up again?

1

I opened a question on Stack Overflow but got no anwser yet, see https://stackoverflow.com/questions/69346392/spring-session-redis-web-session-expiration-notifications-not-delayed-until-appl **Current Behavior** Currently using Spring Session Redis in a Spring Boot 2.5.3 web application. The application...

fbeaufume