Session IDs are not cleaned up in principal index after Session ID changed when using Redis

[ashitikov-bld]

Principal index org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME accumulates old session ID values. These session IDs were replaced with the new ones during authentication phase because of the applied ChangeSessionIdAuthenticationStrategy. Session ID change is not tracked somehow and does not trigger RedisIndexedSessionRepository#cleanupPrincipalIndex.

[Alexey-Makarevich]

Voting for fix.
Does this bug apply only to implementation backed by Redis or to implementation backed by Hazelcast too?

[ashitikov-bld]

@eleftherias Could you please provide any feedback?

[eleftherias]

Thanks for the ping @ashitikov-bld. Do you have a sample that reproduces this issue?

[spring-projects-issues]

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

[ashitikov-bld]

@eleftherias Please, have a look at https://github.com/ashitikov-bld/demo

[ashitikov-bld]

@eleftherias Hi, any feedback?