For the latest stable version, please use Spring Session 3.1.7! |
Common Configurations
This section contains common configurations that applies to all or most Spring Session modules. It contains configuration examples for the following use cases:
-
I need to customize the session cookie properties
Customizing Session Cookie
Once you have set up Spring Session, you can customize how the session cookie is written by exposing a CookieSerializer
as a Spring bean.
Spring Session comes with DefaultCookieSerializer
.
Exposing the DefaultCookieSerializer
as a Spring bean augments the existing configuration when you use configurations like @EnableRedisHttpSession
.
The following example shows how to customize Spring Session’s cookie:
@Bean
public CookieSerializer cookieSerializer() {
DefaultCookieSerializer serializer = new DefaultCookieSerializer();
serializer.setCookieName("JSESSIONID"); (1)
serializer.setCookiePath("/"); (2)
serializer.setDomainNamePattern("^.+?\\.(\\w+\\.[a-z]+)$"); (3)
return serializer;
}
1 | We customize the name of the cookie to be JSESSIONID . |
2 | We customize the path of the cookie to be / (rather than the default of the context root). |
3 | We customize the domain name pattern (a regular expression) to be ^.?\\.(\\w\\.[a-z]+)$ .
This allows sharing a session across domains and applications.
If the regular expression does not match, no domain is set and the existing domain is used.
If the regular expression matches, the first grouping is used as the domain.
This means that a request to child.example.com sets the domain to example.com .
However, a request to localhost:8080/ or 192.168.1.100:8080/ leaves the cookie unset and, thus, still works in development without any changes being necessary for production. |
You should only match on valid domain characters, since the domain name is reflected in the response. Doing so prevents a malicious user from performing such attacks as HTTP Response Splitting. |
Configuration Options
The following configuration options are available:
-
cookieName
: The name of the cookie to use. Default:SESSION
. -
useSecureCookie
: Specifies whether a secure cookie should be used. Default: Use the value ofHttpServletRequest.isSecure()
at the time of creation. -
cookiePath
: The path of the cookie. Default: The context root. -
cookieMaxAge
: Specifies the max age of the cookie to be set at the time the session is created. Default:-1
, which indicates the cookie should be removed when the browser is closed. -
jvmRoute
: Specifies a suffix to be appended to the session ID and included in the cookie. Used to identify which JVM to route to for session affinity. With some implementations (that is, Redis) this option provides no performance benefit. However, it can help with tracing logs of a particular user. -
domainName
: Allows specifying a specific domain name to be used for the cookie. This option is simple to understand but often requires a different configuration between development and production environments. SeedomainNamePattern
as an alternative. -
domainNamePattern
: A case-insensitive pattern used to extract the domain name from theHttpServletRequest#getServerName()
. The pattern should provide a single grouping that is used to extract the value of the cookie domain. If the regular expression does not match, no domain is set and the existing domain is used. If the regular expression matches, the first grouping is used as the domain. -
sameSite
: The value for theSameSite
cookie directive. To disable the serialization of theSameSite
cookie directive, you may set this value tonull
. Default:Lax
-
rememberMeRequestAttribute
: The request attribute name that indicates remember-me login. If specified, the cookie will be written asInteger.MAX_VALUE
.
If you are using |
Custom Cookie in WebFlux
You can customize how the session cookie is written in a WebFlux application by exposing a WebSessionIdResolver
as a Spring bean.
Spring Session uses a CookieWebSessionIdResolver
by default.
The following example shows how to customize Spring Session’s cookie:
@Bean
public WebSessionIdResolver webSessionIdResolver() {
CookieWebSessionIdResolver resolver = new CookieWebSessionIdResolver();
resolver.setCookieName("JSESSIONID"); (1)
resolver.addCookieInitializer((builder) -> builder.path("/")); (2)
resolver.addCookieInitializer((builder) -> builder.sameSite("Strict")); (3)
return resolver;
}
1 | We customize the name of the cookie to be JSESSIONID . |
2 | We customize the path of the cookie to be / (rather than the default of the context root). |
3 | We customize the SameSite cookie directive to be Strict . |