在RedisOperationsSessionRepository中清理会导致会话被错误地删除

https://github.com/spring-projects/spring-session/issues/92

    

 */
public class RedisOperationsSessionRepository implements SessionRepository<RedisOperationsSessionRepository.RedisSession> {
	/**
	 * The prefix for each key of the Redis Hash representing a single session. The suffix is the unique session id.
	 */
	static final String BOUNDED_HASH_KEY_PREFIX = "spring:session:sessions:";

	/**
	 * The key in the Hash representing {@link org.springframework.session.ExpiringSession#getCreationTime()}
	 */
	static final String CREATION_TIME_ATTR = "creationTime";

	/**
	 * The key in the Hash representing {@link org.springframework.session.ExpiringSession#getMaxInactiveIntervalInSeconds()}
	 */
	static final String MAX_INACTIVE_ATTR = "maxInactiveInterval";

	/**
	 * The key in the Hash representing {@link org.springframework.session.ExpiringSession#getLastAccessedTime()}
	 */
	static final String LAST_ACCESSED_ATTR = "lastAccessedTime";

	/**
	 * The prefix of the key for used for session attributes. The suffix is the name of the session attribute. For
	 * example, if the session contained an attribute named attributeName, then there would be an entry in the hash named
	 * sessionAttr:attributeName that mapped to its value.
	 */
	static final String SESSION_ATTR_PREFIX = "sessionAttr:";

	private final RedisOperations<String,ExpiringSession> sessionRedisOperations;

	private final RedisSessionExpirationPolicy expirationPolicy;

	/**
	 * If non-null, this value is used to override the default value for {@link RedisSession#setMaxInactiveIntervalInSeconds(int)}.
	 */
	private Integer defaultMaxInactiveInterval;

	/**
	 * Allows creating an instance and uses a default {@link RedisOperations} for both managing the session and the expirations.
	 *
	 * @param redisConnectionFactory the {@link RedisConnectionFactory} to use.
	 */
	@SuppressWarnings("unchecked")
	public RedisOperationsSessionRepository(RedisConnectionFactory redisConnectionFactory) {
		this(createDefaultTemplate(redisConnectionFactory));
	}

	/**
	 * Creates a new instance. For an example, refer to the class level javadoc.
	 *
	 * @param sessionRedisOperations The {@link RedisOperations} to use for managing the sessions. Cannot be null.
	 */
	public RedisOperationsSessionRepository(RedisOperations<String, ExpiringSession> sessionRedisOperations) {
		Assert.notNull(sessionRedisOperations, "sessionRedisOperations cannot be null");
		this.sessionRedisOperations = sessionRedisOperations;
		this.expirationPolicy = new RedisSessionExpirationPolicy(sessionRedisOperations);
	}

	/**
	 * Sets the maximum inactive interval in seconds between requests before newly created sessions will be
	 * invalidated. A negative time indicates that the session will never timeout. The default is 1800 (30 minutes).
	 *
	 *  @param defaultMaxInactiveInterval the number of seconds that the {@link Session} should be kept alive between
	 *                                    client requests.
	 */
	public void setDefaultMaxInactiveInterval(int defaultMaxInactiveInterval) {
		this.defaultMaxInactiveInterval = defaultMaxInactiveInterval;
	}

	public void save(RedisSession session) {
		session.saveDelta();
	}

	@Scheduled(cron="0 * * * * *")
	public void cleanupExpiredSessions() {
		this.expirationPolicy.cleanExpiredSessions();
	}

	public RedisSession getSession(String id) {
		return getSession(id, false);
	}

 

 

pring Session依赖于Redis 的删除和过期密钥空间通知，分别触发SessionDeletedEvent和SessionExpiredEvent。它是SessionDeletedEvent或SessionExpiredEvent，以确保与会议相关的资源将会被清理。例如，当使用Spring Session的WebSocket支持时，Redis过期或删除事件是什么触发与会话关联的任何WebSocket连接。

会话密钥本身不直接跟踪到期时间，因为这将意味着会话数据将不再可用。而是使用特殊的会话到期密钥。在我们的例子中，到期关键是：

APPEND spring：session：sessions：expires：33fdd1b6-b496-4b33-9f7d-df96679d32fe“”
EXPIRE spring：session：sessions：expires：33fdd1b6-b496-4b33-9f7d-df96679d32fe 1800
当会话到期时，密钥被删除或到期，密钥空间通知触发实际会话的查找，并触发一个SessionDestroyedEvent。

仅依靠Redis到期的一个问题是，Redis不保证何时未通过密钥访问过期的事件。具体来说，Redis用于清除过期密钥的后台任务是低优先级任务，可能不会触发密钥到期。有关其他详细信息，请参阅Redis文档中的过期事件时间段。

为了规避过期事件不能保证发生的事实，我们可以确保在预期到期时访问每个密钥。这意味着如果TTL在该键上过期，当我们尝试访问它们的键时，Redis将删除该键并触发过期的事件。

因此，每个会话到期也跟踪到最近的分钟。这允许后台任务访问潜在的过期会话，以确保以更确定性的方式触发Redis过期事件。例如：

SADD spring：session：expirations：1439245080000 expires：33fdd1b6-b496-4b33-9f7d-df96679d32fe
EXPIRE spring：session：expirations1439245080000 2100
后台任务将使用这些映射来明确地请求每个密钥。通过访问他们的密钥而不是删除它们，我们确保只有当TTL过期时，Redis才会删除该密钥。

我们没有明确删除密钥，因为在某些情况下，可能存在不正确地将密钥识别为过期的竞争条件。没有使用分布式锁（这会杀死我们的性能），没有办法确保到期映射的一致性。通过简单的访问密钥，我们确保该密钥只有在该密钥的TTL过期时才被删除。

 

spring session 文档

 

https://docs.spring.io/spring-session/docs/current/reference/html5/