maxInactiveInterval < 0 but redis session still expired

[hdsuperman]

Source:

spring-session/spring-session-data-redis/src/main/java/org/springframework/session/data/redis/RedisIndexedSessionRepository.java

Lines 930 to 962 in 2353d8b

	createShadowKey(sessionExpireInSeconds);
	long fiveMinutesAfterExpires = sessionExpireInSeconds + TimeUnit.MINUTES.toSeconds(5);
	RedisIndexedSessionRepository.this.sessionRedisOperations.boundHashOps(getSessionKey(getId()))
	.expire(fiveMinutesAfterExpires, TimeUnit.SECONDS);
	RedisIndexedSessionRepository.this.expirationStore.save(this);
	this.delta = new HashMap<>(this.delta.size());
	}
	private void createShadowKey(long sessionExpireInSeconds) {
	String keyToExpire = "expires:" + getId();
	String sessionKey = getSessionKey(keyToExpire);
	if (sessionExpireInSeconds < 0) {
	BoundValueOperations<String, Object> valueOps = RedisIndexedSessionRepository.this.sessionRedisOperations
	.boundValueOps(sessionKey);
	valueOps.append("");
	valueOps.persist();
	RedisIndexedSessionRepository.this.sessionRedisOperations.boundHashOps(getSessionKey(getId()))
	.persist();
	}
	if (sessionExpireInSeconds == 0) {
	RedisIndexedSessionRepository.this.sessionRedisOperations.delete(sessionKey);
	}
	else {
	BoundValueOperations<String, Object> valueOps = RedisIndexedSessionRepository.this.sessionRedisOperations
	.boundValueOps(sessionKey);
	valueOps.append("");
	valueOps.expire(sessionExpireInSeconds, TimeUnit.SECONDS);
	}
	}

Bug

The following code will always execute, Regardless of whether maxInactiveInterval is less than 0

RedisIndexedSessionRepository.this.sessionRedisOperations.boundHashOps(getSessionKey(getId()))
				.expire(fiveMinutesAfterExpires, TimeUnit.SECONDS);

This code in createShadowKey will always be skipped:

if (sessionExpireInSeconds < 0) {
	...
	RedisIndexedSessionRepository.this.sessionRedisOperations.boundHashOps(getSessionKey(getId()))
		.persist();
}

How to fix

long sessionExpireInSeconds = getMaxInactiveInterval().getSeconds();

createShadowKey(sessionExpireInSeconds);

if (sessionExpireInSeconds > 0) {
    long fiveMinutesAfterExpires = sessionExpireInSeconds + TimeUnit.MINUTES.toSeconds(5);
    RedisIndexedSessionRepository.this.sessionRedisOperations.boundHashOps(getSessionKey(getId()))
	.expire(fiveMinutesAfterExpires, TimeUnit.SECONDS);
}

RedisIndexedSessionRepository.this.expirationStore.save(this);
this.delta = new HashMap<>(this.delta.size());