ERR no such key when RedisOperationsSessionRepository.saveChangeSessionId called #1270
Comments
Attempting to change session id for a deleted session currently results in "ERR no such key" error on rename operation of expired key. This commit addressed the problem by ignoring the aforementioned error. Closes #1137
|
Thanks for the report @wangzw - can you describe how to reproduce this? A minimal sample would be the most helpful. |
vpavic
added
the
status: waiting-for-feedback
|
It is hard to reproduce since it happened on our online production. Customer reported a 500 error and from the logs, we found above exception. From #1137 , there are two |
|
Thanks for following up. Yes, at the time it was intentional to only handle ERR no such key for expiration key. However, the session key itself should be there 5 minutes after the session was deleted (see reference manual section on handling expirations) so this truly looks like an exceptional situation. Therefore I think it's important to understand under which circumstances the error occurs. |
|
Thanks for your feedback, I'm currently working on the investigation. The session is definitely not expired in 5 minutes. It happened just after I login. It is a restful api, and I set session policy to |
|
If That is the case we should catch when rename a session. Temporary workaround is to change session policy to NEVER. |
|
@vpavic What is your opinion to fix this issue? |
|
It's still not clear to me how to reproduce the problem @wangzw. Can you provide a minimal sample application that reproduces the problem? It's unclear to me what's your use case with Spring Session and |
|
I have a project to manage user account, it handle user authentication with spring-security (endpoint The project should support HA some two instances is running at the same time. So I use redis based distributed session for spring-security to handle login process. User management API is restful, so it is configured as SessionCreationPolicy.STATELESS. I do not know if there is a simply way to reproduce this issue. From my investigation, there is a race condition between session clean and session rename if In the previous comments you mentioned that the session key itself should be there 5 minutes after the session was deleted, but it is not true from my investigation. |
Since I've been unable to reproduce this, I'm afraid we really need a sample app to be able to move forward with this. |
|
@wangzw |
|
Closing due to lack of feedback. Please comment back if you can provide more details and we can re-open the issue. |
vpavic
removed
the
status: waiting-for-feedback
|
We have the same issue but I have no reproduce scenario. IMHO, this part is a cause of this problem. When I deployed the following patch here in our environment, we did not see this problem. String originalSessionIdKey = getSessionKey(this.originalSessionId);
String sessionIdKey = getSessionKey(sessionId);
try {
RedisOperationsSessionRepository.this.sessionRedisOperations.rename(
originalSessionIdKey, sessionIdKey);
String originalExpiredKey = getExpiredKey(this.originalSessionId);
String expiredKey = getExpiredKey(sessionId);
RedisOperationsSessionRepository.this.sessionRedisOperations.rename(
originalExpiredKey, expiredKey);
} |
vpavic
added
the
status: waiting-for-feedback
|
We use spring-session-core and spring-session-data-redis v2.1.1.RELEASE. @Configuration
@EnableRedisHttpSession
public class AppSessionConfiguration {
@Bean
public static ConfigureRedisAction configureRedisAction() {
// https://github.com/spring-projects/spring-session/issues/124
return ConfigureRedisAction.NO_OP;
}
}@Configuration
@EnableResourceServer
public class AppOAuth2ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
// ...
@Override
public void configure(HttpSecurity http) throws Exception {
// ...
http.requestMatcher(API_ENDPOINT_MATCHER);
http.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
// ...
}
}@Configuration
@EnableAuthorizationServer
public class AppOAuth2AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
// ...
}@Configuration
@EnableWebSecurity
public class AppWebSecurityConfiguration extends WebSecurityConfigurerAdapter {
// ...
@Override
protected void configure(HttpSecurity http) throws Exception {
// ...
http.requestMatcher(UI_ENDPOINT_MATCHER);
http.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
// ...
}
}And we only see this problem when a client access to OAuth2 token endpoint ( The token endpoint should be irrelevant to the session, and no session cookie has been issued. So it is incomprehensible... |
|
I'm also seeing this error in the logs: |
vpavic
added
type: bug
|
Hi @vpavic , |
|
Yes @veereshwaran, the native support for |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
I've classified this as bug (see labels), so we'll try to do something about it. |
|
Knowing the issue was due to a concurrent requests attempting to change session id, putting together a unit test that reproduces the problem wasn't difficult - I've added handling for |
|
Hi @vpavic, here you handling that exception, but when I run my sample application(https://github.com/veereshwaran/sso-server) with your new changes, By clicking refresh button it shows login page randomly. |
|
As explained, the actual root of the problem is that the application makes concurrent requests attempting to change session id. What we did here was simply to prevent the We simply cannot do anything to prevent the concurrent requests attempt to change the session id, that's something that needs to be handled at application level. |
Hi all
I got the following exception and seems the session is already gone before rename. Should we ignore such exception?
Version: spring-session-data-redis-2.1.2.RELEASE
I guess that #1137 d3134ad did not fix all issues.
The text was updated successfully, but these errors were encountered: