✅ Session Management in Spring Boot

Session management in Spring Boot is about tracking user state across multiple HTTP requests — typically used for login sessions, shopping carts, etc.

🧱 1. Default Behavior (HTTP Session)

Spring Boot (with Spring MVC + Spring Security) automatically creates a HttpSession when needed. By default, sessions are stored in-memory on the server.

✅ Example:

@RequestMapping("/set")
public String setSession(HttpSession session) {
    session.setAttribute("user", "aftab");
    return "Session set";
}

@RequestMapping("/get")
public String getSession(HttpSession session) {
    return "User: " + session.getAttribute("user");
}

🛡️ 2. Session with Spring Security

When Spring Security is added:

  • Session is created after authentication
  • User details are stored in the SecurityContext (inside session)
jSecurityContextHolder.getContext().getAuthentication().getName();

⚙️ 3. Session Configuration (in application.properties)

# Session timeout in seconds
server.servlet.session.timeout=15m

# Session cookie settings
server.servlet.session.cookie.name=MYSESSION

🧊 4. Session Management Strategies in Spring Security

http
  .sessionManagement()
    .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
    .maximumSessions(1)
    .maxSessionsPreventsLogin(true);

Strategy Description
ALWAYS Always create a session
IF_REQUIRED (default) Create only when needed
NEVER Never create a session
STATELESS Do not use session at all (for REST)

 

🧰 5. Distributed Session Management

For scalability, use external stores:

Storage How to Enable
Redis spring-session-data-redis
JDBC spring-session-jdbc
Hazelcast spring-session-hazelcast
Example with Redis:
<dependency>
  <groupId>org.springframework.session</groupId>
  <artifactId>spring-session-data-redis</artifactId>
</dependency>

In application.properties:

spring.session.store-type=redis

🔒 6. Session Invalidation & Logout

http.logout().logoutUrl("/logout").invalidateHttpSession(true);

✅ Best Practices

  • 🔐 Use HTTPS: To protect session cookies
  • 🚫 Set HttpOnly & Secure flags on cookies
  • 🕒 Set a reasonable session timeout
  • 🌍 Use external session store in distributed apps
Back to blog

Leave a comment