Spring Session

https://docs.spring.io/spring-session/
Admin
Spring Session provides an API and implementations for managing a user's session information in...
Tokens:151,927
Snippets:1,984
Trust Score:10
Update:1 hour ago
Show doc for...
Tokens:
Raw
### Example configuration for WebSocket with Spring Session

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/socket/config/annotation/AbstractSessionWebSocketMessageBrokerConfigurer.html

This example shows a configuration class that extends AbstractSessionWebSocketMessageBrokerConfigurer, overriding configureStompEndpoints to add a STOMP endpoint at '/messages' with SockJS, and configureMessageBroker to enable a simple broker for '/queue/' and '/topic/' prefixes and set application destination prefix to '/app'. This setup integrates Spring Session with WebSocket messaging.

```java
@Configuration
@EnableScheduling
@EnableWebSocketMessageBroker
public class WebSocketConfig<S extends Session> extends AbstractSessionWebSocketMessageBrokerConfigurer<S> {
    @Override
    protected void configureStompEndpoints(StompEndpointRegistry registry) {
        registry.addEndpoint("/messages")
                .withSockJS();
    }

    @Override
    public void configureMessageBroker(MessageBrokerRegistry registry) {
        registry.enableSimpleBroker("/queue/", "/topic/");
        registry.setApplicationDestinationPrefixes("/app");
    }
}
```

--------------------------------

### Run the httpsession-jdbc-boot sample application

Source: https://docs.spring.io/spring-session/reference/guides/boot-jdbc.html

Run the sample application using Gradle. After starting, access it at localhost:8080/.

```bash
$ ./gradlew :spring-session-sample-boot-jdbc:bootRun
```

--------------------------------

### Run the Boot Sample Application with Gradle

Source: https://docs.spring.io/spring-session/reference/guides/boot-redis.html

Starts the Spring Boot Redis sample application. Requires Redis 2.8+ running on localhost:6379.

```bash
$ ./gradlew :spring-session-sample-boot-redis:bootRun
```

--------------------------------

### Run the REST sample application with Gradle

Source: https://docs.spring.io/spring-session/reference/guides/java-rest.html

Starts the sample application on Tomcat. Requires Redis 2.8+ running on localhost:6379, or update RedisConnectionFactory to point to another server. Access the app at localhost:8080/.

```bash
$ ./gradlew :spring-session-sample-javaconfig-rest:tomcatRun
```

--------------------------------

### Run the security sample application with Gradle

Source: https://docs.spring.io/spring-session/reference/guides/java-security.html

Command to start the Spring Session security sample application using Gradle's tomcatRun task. Requires Redis 2.8+ running on localhost with default port 6379.

```bash
$ ./gradlew :spring-session-sample-javaconfig-security:tomcatRun
```

--------------------------------

### Inspect Redis keys with redis-cli

Source: https://docs.spring.io/spring-session/reference/api.html

Starts redis-cli and lists all keys. The output shows a session key with a suffix that is the session identifier.

```bash
$ redis-cli
redis 127.0.0.1:6379> keys *
1) "spring:session:sessions:4fc39ce3-63b3-4e17-b1c4-5e1ed96fb021"
```

--------------------------------

### Run the WebSocket sample application with Gradle

Source: https://docs.spring.io/spring-session/reference/guides/boot-websocket.html

Use this command to start the Spring Session WebSocket sample application. It requires Redis 2.8+ running on localhost with default port 6379.

```bash
$ ./gradlew :spring-session-sample-boot-websocket:bootRun
```

--------------------------------

### Response showing X-Auth-Token and username

Source: https://docs.spring.io/spring-session/reference/guides/java-rest.html

Example output from the authenticated request. Shows HTTP 200, the X-Auth-Token header containing the session ID, and the JSON body with the username.

```http
HTTP/1.1 200 OK
...
X-Auth-Token: 0dc1f6e1-c7f1-41ac-8ce2-32b6b3e57aa3

{"username":"user"}
```

--------------------------------

### Logout response with empty X-Auth-Token

Source: https://docs.spring.io/spring-session/reference/guides/java-rest.html

Example output from the logout request. Shows HTTP 204 No Content and an empty X-Auth-Token header.

```http
HTTP/1.1 204 No Content
...
X-Auth-Token:
```

--------------------------------

### Response with session token for Redis deletion

Source: https://docs.spring.io/spring-session/reference/guides/java-rest.html

Example output from the session creation request. Shows the X-Auth-Token value that can be used to delete the session from Redis.

```http
HTTP/1.1 200 OK
...
X-Auth-Token: 7e8383a4-082c-4ffe-a4bc-c40fd3363c5e

{"username":"user"}
```

--------------------------------

### HTTP response with session ID header

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/http/HeaderHttpSessionIdResolver.html

Example HTTP response when a session is created, showing the X-Auth-Token header with the session ID value.

```http
HTTP/1.1 200 OK
X-Auth-Token: f81d4fae-7dec-11d0-a765-00a0c91e6bf6
```

--------------------------------

### EnableSpringWebSession Configuration Example

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/config/annotation/web/server/EnableSpringWebSession.html

Use this annotation on a @Configuration class to enable WebFlux session support. A ReactiveSessionRepository bean must be defined, otherwise startup fails with a clear error message.

```java
@Configuration(proxyBeanMethods = false)
@EnableSpringWebSession
public class SpringWebFluxConfig {

    @Bean
    public ReactiveSessionRepository sessionRepository() {
        return new ReactiveMapSessionRepository(new ConcurrentHashMap<>());
    }

}
```

--------------------------------

### Customize SQL queries with set*Query methods

Source: https://docs.spring.io/spring-session/reference/configuration/jdbc.html

Define a `SessionRepositoryCustomizer<JdbcIndexedSessionRepository>` bean that sets custom SQL queries for creating and updating session attributes. The queries use the `%TABLE_NAME%` placeholder, which is replaced by the configured table name. The example uses PostgreSQL-specific syntax with `ON CONFLICT` and `convert_from`.

```java
@Configuration
@EnableJdbcHttpSession
public class SessionConfig {

    @Bean
    public QueryCustomizer tableNameCustomizer() {
        return new QueryCustomizer();
    }

}

public class QueryCustomizer
        implements SessionRepositoryCustomizer<JdbcIndexedSessionRepository> {

    private static final String CREATE_SESSION_ATTRIBUTE_QUERY = """
            INSERT INTO %TABLE_NAME%_ATTRIBUTES (SESSION_PRIMARY_ID, ATTRIBUTE_NAME, ATTRIBUTE_BYTES) (1)
            VALUES (?, ?, ?)
            ON CONFLICT (SESSION_PRIMARY_ID, ATTRIBUTE_NAME)
            DO NOTHING
            """;

    private static final String UPDATE_SESSION_ATTRIBUTE_QUERY = """
		UPDATE %TABLE_NAME%_ATTRIBUTES
		SET ATTRIBUTE_BYTES = convert_from(?, 'UTF8')::jsonb
		WHERE SESSION_PRIMARY_ID = ?
		AND ATTRIBUTE_NAME = ?
		""";

    @Override
    public void customize(JdbcIndexedSessionRepository sessionRepository) {
        sessionRepository.setCreateSessionAttributeQuery(CREATE_SESSION_ATTRIBUTE_QUERY);
        sessionRepository.setUpdateSessionAttributeQuery(UPDATE_SESSION_ATTRIBUTE_QUERY);
    }

}
```

--------------------------------

### getSessionDispatcherTypes()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/context/AbstractHttpSessionApplicationInitializer.html

Gets the DispatcherType for the springSessionRepositoryFilter.

```APIDOC
## getSessionDispatcherTypes()

### Description
Gets the DispatcherType for the springSessionRepositoryFilter.

### Method
protected EnumSet<jakarta.servlet.DispatcherType> getSessionDispatcherTypes()

### Parameters
None.

### Response
- **EnumSet<DispatcherType>** - The dispatcher types.
```

--------------------------------

### Run the sample application with Gradle

Source: https://docs.spring.io/spring-session/reference/guides/xml-jdbc.html

Command to run the sample application using Gradle's tomcatRun task. After running, the application is accessible at localhost:8080/.

```bash
$ ./gradlew :spring-session-sample-xml-jdbc:tomcatRun
```

--------------------------------

### getResponse()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/http/CookieSerializer.CookieValue.html

Gets the response to write to.

```APIDOC
## getResponse()

### Description
Gets the response to write to.

### Method
`public jakarta.servlet.http.HttpServletResponse getResponse()`

### Returns
- **response** (jakarta.servlet.http.HttpServletResponse) - The response to write to. Cannot be null.
```

--------------------------------

### Run the httpsession sample application with Gradle

Source: https://docs.spring.io/spring-session/reference/guides/java-redis.html

Command to run the sample application using Gradle. Requires Redis 2.8+ on localhost with default port 6379, or update RedisConnectionFactory or use Docker.

```bash
$ ./gradlew :spring-session-sample-javaconfig-redis:tomcatRun
```

--------------------------------

### getRequest()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/http/CookieSerializer.CookieValue.html

Gets the request to use.

```APIDOC
## getRequest()

### Description
Gets the request to use.

### Method
`public jakarta.servlet.http.HttpServletRequest getRequest()`

### Returns
- **request** (jakarta.servlet.http.HttpServletRequest) - The request to use. Cannot be null.
```

--------------------------------

### Custom SpringSessionWebSession implementing WebSession

Source: https://docs.spring.io/spring-session/reference/web-session.html

A custom WebSession implementation that delegates to Spring Session's Session. It tracks state (NEW, STARTED) and provides methods like start(), isStarted(), and changeSessionId(). Other methods are omitted for brevity.

```java
public class SpringSessionWebSession implements WebSession {

	enum State {
		NEW, STARTED
	}

	private final S session;

	private AtomicReference<State> state = new AtomicReference<>();

	SpringSessionWebSession(S session, State state) {
		this.session = session;
		this.state.set(state);
	}

	@Override
	public void start() {
		this.state.compareAndSet(State.NEW, State.STARTED);
	}

	@Override
	public boolean isStarted() {
		State value = this.state.get();
		return (State.STARTED.equals(value)
				|| (State.NEW.equals(value) && !this.session.getAttributes().isEmpty()));
	}

	@Override
	public Mono<Void> changeSessionId() {
		return Mono.defer(() -> {
			this.session.changeSessionId();
			return save();
		});
	}

	// ... other methods delegate to the original Session
}
```

--------------------------------

### onStartup(ServletContext servletContext)

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/context/AbstractHttpSessionApplicationInitializer.html

Called by the servlet container during startup to initialize the application. This method is specified by the WebApplicationInitializer interface.

```APIDOC
## onStartup(ServletContext servletContext)

### Description
Called by the servlet container during startup to initialize the application. This method is specified by the `WebApplicationInitializer` interface.

### Method
public void onStartup(jakarta.servlet.ServletContext servletContext)

### Parameters
- **servletContext** (jakarta.servlet.ServletContext) - Required - The servlet context to initialize

### Specified By
- `onStartup` in interface `org.springframework.web.WebApplicationInitializer`
```

--------------------------------

### getOriginalId()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/MapSession.html

Get the original session id.

```APIDOC
## getOriginalId()

### Description
Get the original session id.

### Method
`public String getOriginalId()`

### Parameters
None.

### Returns
- **String** - The original session id.

```

--------------------------------

### getCreationTime()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/MapSession.html

Gets the time when this session was created.

```APIDOC
## getCreationTime()

### Description
Gets the time when this session was created.

### Method
`public Instant getCreationTime()`

### Parameters
None.

### Returns
- **Instant** - The creation time.

```

--------------------------------

### Run the httpsession-jdbc sample with Gradle

Source: https://docs.spring.io/spring-session/reference/guides/java-jdbc.html

Use this command to run the sample application with Tomcat. After running, access the application at localhost:8080/.

```bash
$ ./gradlew :spring-session-sample-javaconfig-jdbc:tomcatRun
```

--------------------------------

### getLastAccessedTime()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/MapSession.html

Gets the last time this Session was accessed.

```APIDOC
## getLastAccessedTime()

### Description
Gets the last time this `Session` was accessed.

### Method
`public Instant getLastAccessedTime()`

### Parameters
None.

### Returns
- **Instant** - The last accessed time.

```

--------------------------------

### Run webflux-custom-cookie sample application

Source: https://docs.spring.io/spring-session/reference/guides/boot-webflux-custom-cookie.html

Command to run the sample application using Gradle. Requires Redis 2.8+ on localhost with default port 6379, or update RedisConnectionFactory or use Docker.

```bash
$ ./gradlew :spring-session-sample-boot-webflux-custom-cookie:bootRun
```

--------------------------------

### getId()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/MapSession.html

Gets a unique string that identifies the Session.

```APIDOC
## getId()

### Description
Gets a unique string that identifies the `Session`.

### Method
`public String getId()`

### Parameters
None.

### Returns
- **String** - The session id.

```

--------------------------------

### getAttributeNames()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/MapSession.html

Gets the attribute names that have a value associated with it.

```APIDOC
## getAttributeNames()

### Description
Gets the attribute names that have a value associated with it.

### Method
`public Set<String> getAttributeNames()`

### Parameters
None.

### Returns
- **Set<String>** - The set of attribute names.

```

--------------------------------

### onStartup(ServletContext)

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/context/AbstractHttpSessionApplicationInitializer.html

Called by the servlet container during startup to initialize the application.

```APIDOC
## onStartup(ServletContext)

### Description
Called by the servlet container during startup to initialize the application.

### Method
void onStartup(jakarta.servlet.ServletContext servletContext)

### Parameters
- **servletContext** (jakarta.servlet.ServletContext) - Required - The servlet context.

### Response
No return value.
```

--------------------------------

### getMaxInactiveInterval()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/MapSession.html

Gets the maximum inactive interval between requests before this session will be invalidated.

```APIDOC
## getMaxInactiveInterval()

### Description
Gets the maximum inactive interval between requests before this session will be invalidated.

### Method
`public Duration getMaxInactiveInterval()`

### Parameters
None.

### Returns
- **Duration** - The maximum inactive interval.

```

--------------------------------

### AbstractHttpSessionApplicationInitializer(Class<?>... configurationClasses)

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/context/AbstractHttpSessionApplicationInitializer.html

Creates a new instance that will instantiate the `ContextLoaderListener` with the specified configuration classes.

```APIDOC
## AbstractHttpSessionApplicationInitializer(Class<?>... configurationClasses)

### Description
Creates a new instance that will instantiate the `ContextLoaderListener` with the specified classes.

### Method
Constructor

### Signature
protected AbstractHttpSessionApplicationInitializer(Class<?>... configurationClasses)

### Parameters
- **configurationClasses** (Class<?>...) - Required - `@Configuration` classes that will be used to configure the context
```

--------------------------------

### findById(String id)

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/ReactiveMapSessionRepository.html

Gets the Session by the Session.getId() or null if no Session is found.

```APIDOC
## findById(String id)

### Description
Gets the Session by the Session.getId() or null if no Session is found.

### Method
findById

### Parameters
- **id** (String) - Required - The session ID to find.

### Return Type
reactor.core.publisher.Mono<MapSession>

```

--------------------------------

### Run findbyusername sample application with Gradle bootRun

Source: https://docs.spring.io/spring-session/reference/guides/boot-findbyusername.html

Run the findbyusername sample application by executing this Gradle command from the source code root. Requires Redis 2.8+ on localhost with default port 6379, or update RedisConnectionFactory to point to another Redis server.

```bash
$ ./gradlew :spring-session-sample-boot-findbyusername:bootRun
```

--------------------------------

### getRememberMeRequestAttribute

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/http/DefaultCookieSerializer.html

Gets the name of the request attribute that is checked to see if the cookie should be written with Integer.MAX_VALUE.

```APIDOC
## getRememberMeRequestAttribute

### Description
Gets the name of the request attribute that is checked to see if the cookie should be written with `Integer.MAX_VALUE`.

### Method
getRememberMeRequestAttribute

### Returns
- (String, nullable) - The remember me request attribute

### Since
3.2
```

--------------------------------

### Run custom-cookie sample with Gradle

Source: https://docs.spring.io/spring-session/reference/guides/java-custom-cookie.html

Use this command to run the custom-cookie sample application. Requires Redis 2.8+ on localhost with default port 6379, or update RedisConnectionFactory to point to another server.

```bash
$ ./gradlew :spring-session-sample-javaconfig-custom-cookie:tomcatRun
```

--------------------------------

### getRememberMeRequestAttribute()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/http/DefaultCookieSerializer.html

Gets the name of the request attribute that is checked to see if the cookie should be written with Integer.MAX_VALUE.

```APIDOC
## getRememberMeRequestAttribute()

### Description
Gets the name of the request attribute that is checked to see if the cookie should be written with Integer.MAX_VALUE.

### Method
`@Nullable public String getRememberMeRequestAttribute()`

### Returns
String - the name of the request attribute, or null if not set.

```

--------------------------------

### findById(String sessionId)

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/data/redis/RedisSessionRepository.html

Gets the Session by the session ID or null if no Session is found.

```APIDOC
## findById(String sessionId)

### Description
Gets the `Session` by the `Session.getId()` or null if no `Session` is found.

### Method
findById

### Parameters
#### Path Parameters
- **sessionId** (String) - Required - The ID of the session to retrieve.

### Return Type
`@Nullable org.springframework.session.data.redis.RedisSessionRepository.RedisSession`

### Response
#### Success Response
- **RedisSession** - The session with the given ID, or null if not found.

```

--------------------------------

### getAttribute(String attributeName)

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/MapSession.html

Gets the Object associated with the specified name or null if no Object is associated to that name.

```APIDOC
## getAttribute(String attributeName)

### Description
Gets the Object associated with the specified name or null if no Object is associated to that name.

### Method
`public <T> @Nullable T getAttribute(String attributeName)`

### Parameters
- **attributeName** (String) - Required - The name of the attribute to retrieve.

### Returns
- **T** - The attribute value, or null if not found.

```

--------------------------------

### Instantiate ReactiveRedisSessionRepository with ReactiveRedisTemplate

Source: https://docs.spring.io/spring-session/reference/api.html

Creates a ReactiveRedisSessionRepository using a configured ReactiveRedisTemplate. Requires a ReactiveRedisConnectionFactory and serialization context to be set up beforehand.

```java
// ... create and configure connectionFactory and serializationContext ...

ReactiveRedisTemplate<String, Object> redisTemplate = new ReactiveRedisTemplate<>(connectionFactory,
		serializationContext);

ReactiveSessionRepository<? extends Session> repository = new ReactiveRedisSessionRepository(redisTemplate);
```

--------------------------------

### Instantiate RedisSessionRepository with RedisTemplate

Source: https://docs.spring.io/spring-session/reference/api.html

Creates a RedisSessionRepository using a RedisTemplate. The template must be configured with a RedisConnectionFactory before use. This implementation does not support publishing session events.

```java
RedisTemplate<String, Object> redisTemplate = new RedisTemplate<>();

// ... configure redisTemplate ...

SessionRepository<? extends Session> repository = new RedisSessionRepository(redisTemplate);
```

--------------------------------

### HTTP request with session ID header

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/http/HeaderHttpSessionIdResolver.html

Example HTTP request that includes the session ID in the X-Auth-Token header.

```http
GET /messages/ HTTP/1.1
Host: example.com
X-Auth-Token: f81d4fae-7dec-11d0-a765-00a0c91e6bf6
```

--------------------------------

### AbstractHttpSessionApplicationInitializer()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/context/AbstractHttpSessionApplicationInitializer.html

Creates a new instance that assumes the Spring Session configuration is loaded by some other means than this class, such as a ContextLoaderListener created by a subclass of AbstractContextLoaderInitializer.

```APIDOC
## AbstractHttpSessionApplicationInitializer()

### Description
Creates a new instance that assumes the Spring Session configuration is loaded by some other means than this class. For example, a user might create a `ContextLoaderListener` using a subclass of `AbstractContextLoaderInitializer`.

### Method
Constructor

### Signature
protected AbstractHttpSessionApplicationInitializer()

### Parameters
None

### See Also
- `ContextLoaderListener`
```

--------------------------------

### HTTP request including session cookie

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/http/CookieHttpSessionIdResolver.html

Example HTTP request from the client that includes the session cookie in the Cookie header.

```http
GET /messages/ HTTP/1.1
Host: example.com
Cookie: SESSION=f81d4fae-7dec-11d0-a765-00a0c91e6bf6
```

--------------------------------

### ConfigureNotifyKeyspaceEventsReactiveAction()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/data/redis/config/annotation/ConfigureNotifyKeyspaceEventsReactiveAction.html

Constructor for creating a new ConfigureNotifyKeyspaceEventsReactiveAction instance.

```APIDOC
## ConfigureNotifyKeyspaceEventsReactiveAction()

### Description
Creates a new instance of ConfigureNotifyKeyspaceEventsReactiveAction.

### Constructor
`public ConfigureNotifyKeyspaceEventsReactiveAction()`

### Parameters
None.

### Returns
No return value (constructor).

```

--------------------------------

### Authenticate with basic auth and receive X-Auth-Token (curl)

Source: https://docs.spring.io/spring-session/reference/guides/java-rest.html

Sends a request with username 'user' and password 'password'. The response includes a 200 status, an X-Auth-Token header with a new session ID, and the username in the body.

```bash
$ curl -v http://localhost:8080/ -u user:password
```

--------------------------------

### HTTP response with blank session ID header

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/http/HeaderHttpSessionIdResolver.html

Example HTTP response when the session is invalidated, showing the header with a blank value.

```http
HTTP/1.1 200 OK
X-Auth-Token:
```

--------------------------------

### MySqlJdbcIndexedSessionRepositoryCustomizer()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/jdbc/MySqlJdbcIndexedSessionRepositoryCustomizer.html

Constructor for creating a new instance of MySqlJdbcIndexedSessionRepositoryCustomizer.

```APIDOC
## MySqlJdbcIndexedSessionRepositoryCustomizer()

### Description
Creates a new instance of the MySqlJdbcIndexedSessionRepositoryCustomizer class.

### Method
Constructor

### Signature
`public MySqlJdbcIndexedSessionRepositoryCustomizer()`

### Parameters
None

### Returns
A new instance of MySqlJdbcIndexedSessionRepositoryCustomizer.
```

--------------------------------

### getCookieMaxAge()

Source: https://docs.spring.io/spring-session/reference/api/java/org/springframework/session/web/http/CookieSerializer.CookieValue.html

Get the cookie max age. The default is -1 which signals to delete the cookie when the browser is closed, or 0 if cookie value is empty.

```APIDOC
## getCookieMaxAge()

### Description
Get the cookie max age. The default is -1 which signals to delete the cookie when the browser is closed, or 0 if cookie value is empty.

### Method
`public int getCookieMaxAge()`

### Returns
- **cookieMaxAge** (int) - The cookie max age.
```
Tokens:
Raw