-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Description
When using the reactive session implementation, after a successful login, the sessionId is regenerated. When the new sessionId is stored, the associated session keys are renamed correctly, but the old sessionId remains in the sorted set. Because these stale entries are never removed, the sorted set grows indefinitely, eventually causing Redis to run out of memory.
Before login Redis contains the following keys:
"spring:session:sessions:expirations"
"spring:session:sessions:expires:f05c65b8-c71d-42ef-9e1b-d93f6a6d5f33"
"spring:session:sessions:f05c65b8-c71d-42ef-9e1b-d93f6a6d5f33"
The spring:session:sessions:expirations
sorted set contains:
"\xac\xed\x00\x05t\x00$f05c65b8-c71d-42ef-9e1b-d93f6a6d5f33"
"1757351616087"
After successful login Redis has the following keys:
"spring:session:sessions:de97dde2-ced5-4da0-ba5c-94f6965d0f48:idx"
"spring:session:sessions:index:PRINCIPAL_NAME_INDEX_NAME:c9735bb8-d092-4a80-aa93-d9de3bf88d6d"
"spring:session:sessions:expires:de97dde2-ced5-4da0-ba5c-94f6965d0f48"
"spring:session:sessions:expirations"
"spring:session:sessions:de97dde2-ced5-4da0-ba5c-94f6965d0f48"
The spring:session:sessions:expirations
sorted set contains:
"\xac\xed\x00\x05t\x00$f05c65b8-c71d-42ef-9e1b-d93f6a6d5f33" --> This should be removed
"1757351616087"
"\xac\xed\x00\x05t\x00$de97dde2-ced5-4da0-ba5c-94f6965d0f48"
"1757351654216"
In the example above, ReactiveRedisIndexedSessionRepository.RedisSession.saveChangeSessionId()
fails to clean up correctly, which results in a memory leak.
This also breaks the cleanup task: once more than 100 stale entries accumulate in the sorted set, it repeatedly queries the same stale sessions instead of removing valid ones, preventing proper cleanup.
This method should remove the old session Id from the sorted set
https://github.com/spring-projects/spring-session/blob/main/spring-session-data-redis/src/main/java/org/springframework/session/data/redis/ReactiveRedisIndexedSessionRepository.java#L740