Summary

Version: 3.5.5

I believe that RedisSessionConfiguration probably wants to use the spring.session.timeout property as the primary source of the timeout configuration if that property is set, however it looks that only the server.servlet.session.timeout is being respected.

Screenshots

Properties Set:

Image

Configuration Applied

Image

Here you can see that the value from the server.servlet.session.timeout property is what's going to be applied to the repository for defaultMaxInactiveInterval when spring.session property is actually what's going to be applied for the spring session configuration: https://docs.spring.io/spring-boot/reference/web/spring-session.html

For setting the timeout of the session you can use the spring.session.timeout property. If that property is not set with a servlet web application, the auto-configuration falls back to the value of server.servlet.session.timeout.

Comment From: wilkinsona

As far as I can tell, spring.session.timeout will be applied. The code's calling SessionProperties.determineTimeout(Supplier<Duration>):

https://github.com/spring-projects/spring-boot/blob/a465cdbf6697b3a266ac8c36a3ff96b31c7591a6/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/session/RedisSessionConfiguration.java#L78-L80

The Supplier<Duration> is a fallback that's only used when spring.session.timeout is null:

https://github.com/spring-projects/spring-boot/blob/a465cdbf6697b3a266ac8c36a3ff96b31c7591a6/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/session/SessionProperties.java#L73-L75

When spring.session.timeout has been set it will therefore be used and the supplier will never be called. I've verified this with one of our smoke tests. When configured with spring.session.timeout=31d and server.servlet.session.timeout=21d, RedisIndexedSessionRepository.setDefaultMaxInactiveInterval(Duration) is called with PT744H which is 31 days.

I'm going to close this one for now as Spring Boot appears to be behaving correct. If you can provide a minimal example that shows server.servlet.session.timeout being used rather than spring.session.timeout then we can re-open the issue and take another look.

Comment From: adase11

Ah that's my bad, missed the determineTimeout call. apologies @wilkinsona