title: Share Spring Session with Redis Database
body: <p>Following scenario:</p>
  
  <p><strong>DESCRIPTION:</strong></p>
  
  <p>I develop two microservices with Spring. One Service is the auth service and generates the session. The other service is the ui-service which needs to know if a requesting client is authorized. After some reading I found out that sharing the session with redis seems to be a good solution. (Correct me if there is a better way )
  For the coding I followed the example <a href="https://codeboje.de/spring-session-tutorial/" rel="nofollow noreferrer">here</a></p>
  
  <p><strong>Status quo:</strong>
  My auth service works and generates a session in redis:</p>
  
  <p>For example:</p>
  
  <pre><code>127.0.0.1:6379&gt; keys *
  1) "spring:session:sessions:a4c11990-94a4-4b99-bc77-33f2084e5e8f"
  2) "spring:session:sessions:expires:a4c11990-94a4-4b99-bc77-33f2084e5e8f"
  3) "spring:session:sessions:26f24541-74dd-4410-84ac-d051a64d1263"
  4) "spring:session:index:org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME:userA"
  5) "spring:session:expirations:1557314160000"
  6) "spring:session:sessions:expires:26f24541-74dd-4410-84ac-d051a64d1263"
  </code></pre>
  
  <p>Now I want to call a test endpoint of my ui service. This call should be successfull if the session is valid and access denied when there is no valid session.
  Atm I always get an access denied error in my ui service. </p>
  
  <p><strong>Code:</strong>
  <strong>My auth service:</strong> </p>
  
  <blockquote>
    <p>application.properties</p>
  </blockquote>
  
  <pre><code>spring.session.store-type=redis
  spring.session.redis.flush-mode=on-save
  spring.session.redis.namespace=spring:session
  spring.redis.host=localhost
  spring.redis.port=6379
  </code></pre>
  
  <blockquote>
    <p>pom.xml</p>
  </blockquote>
  
  <pre><code>        &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-data-redis&lt;/artifactId&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.session&lt;/groupId&gt;
              &lt;artifactId&gt;spring-session-data-redis&lt;/artifactId&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.session&lt;/groupId&gt;
              &lt;artifactId&gt;spring-session&lt;/artifactId&gt;
              &lt;version&gt;1.3.5.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
  </code></pre>
  
  <blockquote>
    <p>SessionConfig</p>
  </blockquote>
  
  <pre><code>@Configuration
  @EnableRedisHttpSession
  public class SessionConfig extends AbstractHttpSessionApplicationInitializer {
        @Bean
          public JedisConnectionFactory jedisConnectionFactory() {
              return new JedisConnectionFactory();
          }
  @Bean
  public HttpSessionIdResolver httpSessionIdResolver() {
      CookieHttpSessionIdResolver resolver = new CookieHttpSessionIdResolver();
      DefaultCookieSerializer cookieSerializer = new DefaultCookieSerializer();
      cookieSerializer.setUseBase64Encoding(false);
      resolver.setCookieSerializer(cookieSerializer);
      return resolver; 
  }
  </code></pre>
  
  <p>and in my main class I did </p>
  
  <pre><code>@EnableRedisHttpSession
  </code></pre>
  
  <p><strong>And in my UI Service:</strong></p>
  
  <blockquote>
    <p>pom.xml</p>
  </blockquote>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;project xmlns="http://maven.apache.org/POM/4.0.0"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"&gt;
      &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;
      &lt;parent&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-parent&lt;/artifactId&gt;
          &lt;version&gt;2.1.4.RELEASE&lt;/version&gt;
          &lt;relativePath /&gt; &lt;!-- lookup parent from repository --&gt;
      &lt;/parent&gt;
      &lt;groupId&gt;com.test&lt;/groupId&gt;
      &lt;artifactId&gt;Redistest&lt;/artifactId&gt;
      &lt;version&gt;0.0.1-SNAPSHOT&lt;/version&gt;
      &lt;name&gt;Redistest&lt;/name&gt;
      &lt;description&gt;Microservice for Data Management&lt;/description&gt;
  
      &lt;properties&gt;
          &lt;java.version&gt;1.8&lt;/java.version&gt;
      &lt;/properties&gt;
  
      &lt;dependencies&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-test&lt;/artifactId&gt;
              &lt;scope&gt;test&lt;/scope&gt;
          &lt;/dependency&gt;
  
  
                  &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-data-redis&lt;/artifactId&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.session&lt;/groupId&gt;
              &lt;artifactId&gt;spring-session-data-redis&lt;/artifactId&gt;
          &lt;/dependency&gt;
  
              &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.session&lt;/groupId&gt;
              &lt;artifactId&gt;spring-session&lt;/artifactId&gt;
              &lt;version&gt;1.3.5.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;redis.clients&lt;/groupId&gt;
              &lt;artifactId&gt;jedis&lt;/artifactId&gt;
          &lt;/dependency&gt;
      &lt;/dependencies&gt;
  
      &lt;build&gt;
          &lt;plugins&gt;
              &lt;plugin&gt;
                  &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
                  &lt;artifactId&gt;spring-boot-maven-plugin&lt;/artifactId&gt;
              &lt;/plugin&gt;
          &lt;/plugins&gt;
      &lt;/build&gt;
  
  &lt;/project&gt;
  </code></pre>
  
  <blockquote>
    <p>main:</p>
  </blockquote>
  
  <pre><code>@EnableWebSecurity
  @SpringBootApplication
  public class RedistestApplication {
  
      public static void main(String[] args) {
          SpringApplication.run(RedistestApplication.class, args);
      }
  </code></pre>
  
  <blockquote>
    <p>SessionConfig:</p>
  </blockquote>
  
  <pre><code>@Configuration
  @EnableRedisHttpSession
  public class SessionConfig extends AbstractHttpSessionApplicationInitializer {
        @Bean
          public JedisConnectionFactory jedisConnectionFactory() {
              return new JedisConnectionFactory();
              }
   @Bean
      public HttpSessionIdResolver httpSessionIdResolver() {
          return HeaderHttpSessionIdResolver.xAuthToken(); 
      }
  </code></pre>
  
  <blockquote>
    <p>WebSecurity:</p>
  </blockquote>
  
  <pre><code>@Configuration
  public class WebSecurity extends WebSecurityConfigurerAdapter{
  
       @Override
          protected void configure(HttpSecurity http) throws Exception {
              http
                  .authorizeRequests()
                      .anyRequest().authenticated();
          }
  }
  
  }
  </code></pre>
  
  <blockquote>
    <p><strong>Controller</strong></p>
  </blockquote>
  
  <pre><code>@RestController
  public class TestController {
  
      @GetMapping("/name")
      public String getName() {
          return "Hallo From Test";
      }
  
  }
  </code></pre>
  
  <p><strong>QUESTION:</strong>
  I'm not getting any error in my services. It seems like I just can't use the session from reddis. In the tutorial the author says that there might be a problem with the base64 encoding of the session-id in the cookie. I guess this might be the problem. Do you have any suggestion or see any error in my implementation? Do I have to disable the HttpSession exlipcitly?
  Thank's for your help/hints.</p>
  
  <p><strong>EDIT:</strong>
  I just recognized that in my browser Inspect (Firefox) i'm not having any "x-auth" field. My intention is to save the auth id (Session-id) in the header not as a cookie. So I expect that my auth service should set the sessionid as x-auth field in the header. Is that correct? So the error seems to come from the auth service?</p>