Support configuring Spring Session's session cookie using `ServerProperties`

[vpavic]

Spring Session has support for configuring session cookie using Servlet API's SessionCookieConfig, so one would expect it would be possible to configure session cookie using Boot's ServerProperties. This however does not work due to following reasons.

The problem is that Spring Session's CookieSerializer is configured in SpringHttpSessionConfiguration while Boot's customization of SessionCookieConfig with ServerProperties is done in DefaultServletWebServerFactoryCustomizer.SessionConfiguringInitializer and happens after Spring Session has been initializing.

The problem can be observed using spring-boot-sample-session with configuration property server.session.cookie.name=sid, and breakpoints set in org.springframework.boot.autoconfigure.web.servlet.DefaultServletWebServerFactoryCustomizer.SessionConfiguringInitializer#configureSessionCookie and org.springframework.session.config.annotation.web.http.SpringHttpSessionConfiguration#createDefaultCookieSerializer.

Related to #7141.

[vpavic]

Since Boot is applying ServerProperties to SessionCookieConfig in ServletContextInitializer#onStartup I'm not sure how to make this work.

As an alternative, I'd propose to have Boot auto-configure DefaultCookieSerializer directly from ServerProperties, if user hasn't provided one. I've got that implemented in this branch so if that's an acceptable option I'd make it into a PR.

[vpavic]

Any feedback on this, and the accompanying PR (#10440)? Thanks.

[wilkinsona]

The problem is that Spring Session's CookieSerializer is configured in SpringHttpSessionConfiguration while Boot's customization of SessionCookieConfig with ServerProperties is done in DefaultServletWebServerFactoryCustomizer.SessionConfiguringInitializer and happens after Spring Session has been initializing.

This is an interesting problem. Thanks for reporting it, @vpavic. It happens because there's a FilterRegistrationBean (sessionRepositoryFilterRegistration) created for the SessionRepositoryFilter. A FilterRegistrationBean is a ServletContextInitializer so sessionRepositoryFilterRegistration is created when getting all the ServletContextInitializer beans. SessionRepositoryFilter is created by SpringHttpSessionConfiguration so its @PostConstruct init method, which drives the creation of the default cookie serializer, is called before the SessionRepositoryFilter bean can be created.

This is a general problem. Any configuration class that produces a Filter or Servlet can't rely upon the ServletContext having been fully customized (init parameters, cookie config, etc) before it's called. I am wondering if we should move the code that customizes the ServletContext (init parameters, cookie config, etc) to a mechanism other than ServletContextInitializer. I've opened #10699 which I think now supersedes this issue.