Optimize the usage of JacksonMongoSessionConverter to prevent duplica…

.github/dependabot.yml

@@ -9,7 +9,6 @@ updates:
 
   - package-ecosystem: "gradle"
     target-branch: "main"
-    milestone: 154
     directory: "/"
     schedule:
       interval: "daily"
@@ -24,11 +23,10 @@ updates:
       - dependency-name: "org.mockito:mockito-bom"
         update-types: [ "version-update:semver-major" ]
       - dependency-name: "*"
-        update-types: [ "version-update:semver-major",  "version-update:semver-minor" ]
+        update-types: [ "version-update:semver-major" ]
 
   - package-ecosystem: "gradle"
-    target-branch: "3.2.x"
-    milestone: 152
+    target-branch: "3.3.x"
     directory: "/"
     schedule:
       interval: "daily"
@@ -46,8 +44,7 @@ updates:
         update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
 
   - package-ecosystem: "gradle"
-    target-branch: "3.1.x"
-    milestone: 151
+    target-branch: "3.2.x"
     directory: "/"
     schedule:
       interval: "daily"
@@ -71,13 +68,13 @@ updates:
     schedule:
       interval: weekly
   - package-ecosystem: github-actions
-    target-branch: "3.2.x"
+    target-branch: "3.3.x"
     milestone: 152
     directory: "/"
     schedule:
       interval: weekly
   - package-ecosystem: github-actions
-    target-branch: "3.1.x"
+    target-branch: "3.2.x"
     milestone: 151
     directory: "/"
     schedule:
@@ -87,3 +84,9 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+
+  - package-ecosystem: npm
+    target-branch: docs-build
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/release-scheduler.yml

@@ -14,7 +14,7 @@ jobs:
     strategy:
       matrix:
         # List of active maintenance branches.
-        branch: [ main, 3.2.x, 3.1.x ]
+        branch: [ main, 3.3.x, 3.2.x ]
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

git/hooks/prepare-forward-merge

@@ -4,7 +4,7 @@ require 'net/http'
 require 'yaml'
 require 'logger'
 
-$main_branch = "3.3.x"
+$main_branch = "3.4.x"
 
 $log = Logger.new(STDOUT)
 $log.level = Logger::WARN

gradle.properties

@@ -1,3 +1,3 @@
 org.gradle.jvmargs=-Xmx4g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError -Dfile.encoding=UTF-8
 org.gradle.parallel=true
-version=3.3.3-SNAPSHOT
+version=3.4.0-SNAPSHOT

gradle/libs.versions.toml

@@ -9,7 +9,7 @@ org-mongodb = "5.0.1"
 org-seleniumhq-selenium = "4.13.0"
 org-slf4j = "2.0.16"
 org-testcontainers = "1.19.8"
-org-springframework-boot = "3.2.9"
+org-springframework-boot = "3.3.3"
 
 [libraries]
 ch-qos-logback-logback-classic = { module = "ch.qos.logback:logback-classic", version.ref = "ch-qos-logback" }
@@ -58,8 +58,8 @@ org-slf4j-jcl-over-slf4j = { module = "org.slf4j:jcl-over-slf4j", version.ref =
 org-slf4j-log4j-over-slf4j = { module = "org.slf4j:log4j-over-slf4j", version.ref = "org-slf4j" }
 org-slf4j-slf4j-api = { module = "org.slf4j:slf4j-api", version.ref = "org-slf4j" }
 org-springframework-data-spring-data-bom = "org.springframework.data:spring-data-bom:2024.0.3"
-org-springframework-security-spring-security-bom = "org.springframework.security:spring-security-bom:6.3.3"
-org-springframework-spring-framework-bom = "org.springframework:spring-framework-bom:6.1.12"
+org-springframework-security-spring-security-bom = "org.springframework.security:spring-security-bom:6.4.0-SNAPSHOT"
+org-springframework-spring-framework-bom = "org.springframework:spring-framework-bom:6.2.0-M4"
 org-springframework-boot-spring-boot-dependencies = { module = "org.springframework.boot:spring-boot-dependencies", version.ref = "org-springframework-boot" }
 org-springframework-boot-spring-boot-gradle-plugin = { module = "org.springframework.boot:spring-boot-gradle-plugin", version.ref = "org-springframework-boot" }
 org-testcontainers-testcontainers-bom = { module = "org.testcontainers:testcontainers-bom", version.ref = "org-testcontainers" }

spring-session-core/src/main/java/org/springframework/session/web/http/DefaultCookieSerializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2014-2021 the original author or authors.
+ * Copyright 2014-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -86,6 +86,8 @@ public class DefaultCookieSerializer implements CookieSerializer {
 
 	private String sameSite = "Lax";
 
+	private boolean partitioned;
+
 	/*
 	 * @see
 	 * org.springframework.session.web.http.CookieSerializer#readCookieValues(jakarta.
@@ -153,6 +155,9 @@ public void writeCookieValue(CookieValue cookieValue) {
 		if (this.sameSite != null) {
 			sb.append("; SameSite=").append(this.sameSite);
 		}
+		if (this.partitioned) {
+			sb.append("; Partitioned");
+		}
 		response.addHeader("Set-Cookie", sb.toString());
 	}
 
@@ -444,4 +449,13 @@ public String getRememberMeRequestAttribute() {
 		return this.rememberMeRequestAttribute;
 	}
 
+	/**
+	 * Allows defining whether the generated cookie carries the Partitioned attribute.
+	 * @param partitioned whether the generate cookie is partitioned
+	 * @since 3.4
+	 */
+	public void setPartitioned(boolean partitioned) {
+		this.partitioned = partitioned;
+	}
+
 }

spring-session-core/src/test/java/org/springframework/session/web/http/DefaultCookieSerializerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2014-2021 the original author or authors.
+ * Copyright 2014-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -460,6 +460,13 @@ void writeCookieSetSameSiteNull() {
 		assertThat(getCookie().getSameSite()).isNull();
 	}
 
+	@Test
+	void writeCookieWhenPartitionedTrueThenSetPartitionedAttribute() {
+		this.serializer.setPartitioned(true);
+		this.serializer.writeCookieValue(cookieValue(this.sessionId));
+		assertThat(getCookie().isPartitioned()).isTrue();
+	}
+
 	void setCookieName(String cookieName) {
 		this.cookieName = cookieName;
 		this.serializer.setCookieName(cookieName);

spring-session-data-mongodb/src/main/java/org/springframework/session/data/mongo/JacksonMongoSessionConverter.java

@@ -16,11 +16,6 @@
 
 package org.springframework.session.data.mongo;
 
-import java.io.IOException;
-import java.util.Collections;
-import java.util.Date;
-import java.util.HashMap;
-
 import com.fasterxml.jackson.annotation.JsonAutoDetect;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
@@ -37,14 +32,18 @@
 import org.bson.Document;
 import org.bson.json.JsonMode;
 import org.bson.json.JsonWriterSettings;
-
 import org.springframework.data.mongodb.core.query.Criteria;
 import org.springframework.data.mongodb.core.query.Query;
 import org.springframework.lang.Nullable;
 import org.springframework.security.jackson2.SecurityJackson2Modules;
 import org.springframework.session.FindByIndexNameSessionRepository;
 import org.springframework.util.Assert;
 
+import java.io.IOException;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+
 /**
  * {@code AbstractMongoSessionConverter} implementation using Jackson.
  *
@@ -76,11 +75,22 @@ public JacksonMongoSessionConverter(Iterable<Module> modules) {
 	}
 
 	public JacksonMongoSessionConverter(ObjectMapper objectMapper) {
-
-		Assert.notNull(objectMapper, "ObjectMapper can NOT be null!");
+		Assert.notNull(objectMapper, "ObjectMapper can not be null!");
 		this.objectMapper = objectMapper;
 	}
 
+	public JacksonMongoSessionConverter(ObjectMapper objectMapper, boolean copyToUse) {
+		Assert.notNull(objectMapper, "ObjectMapper can not be null!");
+		if (!copyToUse) {
+			configureObjectMapper(objectMapper);
+			this.objectMapper = objectMapper;
+			return;
+		}
+		var objectMapperCopy = objectMapper.copy();
+		configureObjectMapper(objectMapperCopy);
+		this.objectMapper = objectMapperCopy;
+	}
+
 	@Nullable
 	protected Query getQueryForIndex(String indexName, Object indexValue) {
 
@@ -93,9 +103,12 @@ protected Query getQueryForIndex(String indexName, Object indexValue) {
 	}
 
 	private ObjectMapper buildObjectMapper() {
-
 		ObjectMapper objectMapper = new ObjectMapper();
+		this.configureObjectMapper(objectMapper);
+		return objectMapper;
+	}
 
+	private void configureObjectMapper(ObjectMapper objectMapper) {
 		// serialize fields instead of properties
 		objectMapper.setVisibility(PropertyAccessor.ALL, JsonAutoDetect.Visibility.NONE);
 		objectMapper.setVisibility(PropertyAccessor.FIELD, JsonAutoDetect.Visibility.ANY);
@@ -108,8 +121,6 @@ private ObjectMapper buildObjectMapper() {
 		objectMapper.registerModules(SecurityJackson2Modules.getModules(getClass().getClassLoader()));
 		objectMapper.addMixIn(MongoSession.class, MongoSessionMixin.class);
 		objectMapper.addMixIn(HashMap.class, HashMapMixin.class);
-
-		return objectMapper;
 	}
 
 	@Override

spring-session-data-mongodb/src/main/java/org/springframework/session/data/mongo/MongoSession.java

@@ -39,7 +39,7 @@
  * @author Greg Turnquist
  * @since 1.2
  */
-class MongoSession implements Session {
+public final class MongoSession implements Session {
 
 	/**
 	 * Mongo doesn't support {@literal dot} in field names. We replace it with a unicode
@@ -74,20 +74,19 @@ class MongoSession implements Session {
 	 * @param sessionId the session id to use
 	 * @since 3.2
 	 */
-	MongoSession(String sessionId) {
+	public MongoSession(String sessionId) {
 		this(sessionId, MapSession.DEFAULT_MAX_INACTIVE_INTERVAL_SECONDS);
 	}
 
-	MongoSession() {
+	public MongoSession() {
 		this(MapSession.DEFAULT_MAX_INACTIVE_INTERVAL_SECONDS);
 	}
 
-	MongoSession(long maxInactiveIntervalInSeconds) {
+	public MongoSession(long maxInactiveIntervalInSeconds) {
 		this(UuidSessionIdGenerator.getInstance().generate(), maxInactiveIntervalInSeconds);
 	}
 
-	MongoSession(String id, long maxInactiveIntervalInSeconds) {
-
+	public MongoSession(String id, long maxInactiveIntervalInSeconds) {
 		this.id = id;
 		this.originalSessionId = id;
 		this.intervalSeconds = maxInactiveIntervalInSeconds;
@@ -99,7 +98,7 @@ class MongoSession implements Session {
 	 * @param sessionIdGenerator the {@link SessionIdGenerator} to use
 	 * @since 3.2
 	 */
-	MongoSession(SessionIdGenerator sessionIdGenerator) {
+	public MongoSession(SessionIdGenerator sessionIdGenerator) {
 		this(sessionIdGenerator.generate(), MapSession.DEFAULT_MAX_INACTIVE_INTERVAL_SECONDS);
 		this.sessionIdGenerator = sessionIdGenerator;
 	}

spring-session-data-redis/src/integration-test/java/org/springframework/session/data/redis/RedisIndexedSessionRepositoryITests.java

@@ -19,6 +19,7 @@
 import java.nio.charset.StandardCharsets;
 import java.util.Map;
 import java.util.UUID;
+import java.util.concurrent.TimeUnit;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -135,6 +136,22 @@ void saves() throws InterruptedException {
 			.isEqualTo(expectedAttributeValue);
 	}
 
+	@Test
+	void saveThenSaveSessionKeyAndShadowKeyWith5MinutesDifference() {
+		RedisSession toSave = this.repository.createSession();
+		String expectedAttributeName = "a";
+		String expectedAttributeValue = "b";
+		toSave.setAttribute(expectedAttributeName, expectedAttributeValue);
+		this.repository.save(toSave);
+
+		Long sessionKeyExpire = this.redis.getExpire("RedisIndexedSessionRepositoryITests:sessions:" + toSave.getId(),
+				TimeUnit.SECONDS);
+		Long shadowKeyExpire = this.redis
+			.getExpire("RedisIndexedSessionRepositoryITests:sessions:expires:" + toSave.getId(), TimeUnit.SECONDS);
+		long differenceInSeconds = sessionKeyExpire - shadowKeyExpire;
+		assertThat(differenceInSeconds).isEqualTo(300);
+	}
+
 	@Test
 	void putAllOnSingleAttrDoesNotRemoveOld() {
 		RedisSession toSave = this.repository.createSession();