Skip to content

ReactiveRedisIndexedSessionRepository.RedisSession.saveChangeSessionId() doesn't remove old sessionId from sorted set #3471

@runtarinn

Description

@runtarinn

When using the reactive session implementation, after a successful login, the sessionId is regenerated. When the new sessionId is stored, the associated session keys are renamed correctly, but the old sessionId remains in the sorted set. Because these stale entries are never removed, the sorted set grows indefinitely, eventually causing Redis to run out of memory.

Before login Redis contains the following keys:

"spring:session:sessions:expirations"
"spring:session:sessions:expires:f05c65b8-c71d-42ef-9e1b-d93f6a6d5f33"
"spring:session:sessions:f05c65b8-c71d-42ef-9e1b-d93f6a6d5f33"

The spring:session:sessions:expirations sorted set contains:

"\xac\xed\x00\x05t\x00$f05c65b8-c71d-42ef-9e1b-d93f6a6d5f33"
"1757351616087"

After successful login Redis has the following keys:

"spring:session:sessions:de97dde2-ced5-4da0-ba5c-94f6965d0f48:idx"
"spring:session:sessions:index:PRINCIPAL_NAME_INDEX_NAME:c9735bb8-d092-4a80-aa93-d9de3bf88d6d"
"spring:session:sessions:expires:de97dde2-ced5-4da0-ba5c-94f6965d0f48"
"spring:session:sessions:expirations"
"spring:session:sessions:de97dde2-ced5-4da0-ba5c-94f6965d0f48"

The spring:session:sessions:expirations sorted set contains:

"\xac\xed\x00\x05t\x00$f05c65b8-c71d-42ef-9e1b-d93f6a6d5f33"   --> This should be removed
"1757351616087"
"\xac\xed\x00\x05t\x00$de97dde2-ced5-4da0-ba5c-94f6965d0f48"
"1757351654216"

In the example above, ReactiveRedisIndexedSessionRepository.RedisSession.saveChangeSessionId() fails to clean up correctly, which results in a memory leak.
This also breaks the cleanup task: once more than 100 stale entries accumulate in the sorted set, it repeatedly queries the same stale sessions instead of removing valid ones, preventing proper cleanup.

This method should remove the old session Id from the sorted set
https://github.com/spring-projects/spring-session/blob/main/spring-session-data-redis/src/main/java/org/springframework/session/data/redis/ReactiveRedisIndexedSessionRepository.java#L740

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions