Support heterogeneous spring session version in client / server topology

[dougkei]

Suggest to customized serialization of SessionUpdateEntryProcessor such that single hazelcast server cluster can serve clients of different spring session versions (e.g. 1.3.5, 2.0.8 and 2.1.3) concurrently.
Suggested approaches:

• SessionUpdateEntryProcessor to implement Portable
• build StreamSerializer for SessionUpdateEntryProcessor
• SessionUpdateEntryProcessor to provide public getter/setter methods so consumer can build their own serialization mechanism as above

[vpavic]

Thanks for the suggestion @dougkei - we already have #1131 to handle some serialization related improvements. Can you add your comments over there? I think we even might consider this one as duplicate since all those improvements could be implemented together.

[veereshwaran]

I think following code block may cause this issue

spring-session/spring-session-data-redis/src/main/java/org/springframework/session/data/redis/RedisOperationsSessionRepository.java

Line 826 in f00a1b9

saveChangeSessionId(sessionId);

In previous version 1.3

spring-session/spring-session/src/main/java/org/springframework/session/data/redis/RedisOperationsSessionRepository.java

Lines 764 to 769 in 3db2e13

	private void saveDelta() {
	if (this.delta.isEmpty()) {
	return;
	}
	String sessionId = getId();
	getSessionBoundHashOperations(sessionId).putAll(this.delta);

Here It will keep the previous session

I have configured HttpSecurity
http..sessionManagement().sessionFixation().none();

But it is not working.

[vpavic]

@veereshwaran Thanks for the details - however shouldn't these comments go in #1311?

[veereshwaran]

Yes by mistake I posted here

[vpavic]

I'm going to close this one as duplicate of #1131.

[vpavic]

Duplicate of #1131