java 47 lines · 7 steps

Backing HTTP sessions with Redis in Spring

A Spring config class that stores servlet sessions in Redis, tuning the connection, serialization, and cookie behavior.

Explained by highlit
Spring Intermediate session-management redis distributed-state configuration cookies
1@Configuration
2@EnableRedisHttpSession(namespace = "myapp:sessions", maxInactiveIntervalInSeconds = 1800, flushMode = FlushMode.IMMEDIATE)
3public class SessionConfig {
4 
5 @Bean
6 public LettuceConnectionFactory redisConnectionFactory(
7 @Value("${spring.redis.host}") String host,
8 @Value("${spring.redis.port}") int port,
9 @Value("${spring.redis.password:}") String password) {
10 
11 RedisStandaloneConfiguration standalone = new RedisStandaloneConfiguration(host, port);
12 if (!password.isBlank()) {
13 standalone.setPassword(RedisPassword.of(password));
14 }
15 
16 LettuceClientConfiguration clientConfig = LettuceClientConfiguration.builder()
17 .commandTimeout(Duration.ofSeconds(2))
18 .clientOptions(ClientOptions.builder()
19 .autoReconnect(true)
20 .disconnectedBehavior(ClientOptions.DisconnectedBehavior.REJECT_COMMANDS)
21 .build())
22 .build();
23 
24 return new LettuceConnectionFactory(standalone, clientConfig);
25 }
26 
27 @Bean
28 public RedisSerializer<Object> springSessionDefaultRedisSerializer() {
29 return new GenericJackson2JsonRedisSerializer();
30 }
31 
32 @Bean
33 public CookieSerializer cookieSerializer() {
34 DefaultCookieSerializer serializer = new DefaultCookieSerializer();
35 serializer.setCookieName("MYAPPSESSION");
36 serializer.setCookiePath("/");
37 serializer.setUseHttpOnlyCookie(true);
38 serializer.setSameSite("Lax");
39 serializer.setUseSecureCookie(true);
40 return serializer;
41 }
42 
43 @Bean
44 public ConfigureRedisAction configureRedisAction() {
45 return ConfigureRedisAction.NO_OP;
46 }
47}
01 / 01
STEP 01

Walkthrough

Space play ←→ step click any line
Three takeaways
  1. 1Externalizing HTTP sessions to Redis lets multiple app instances share login state without sticky sessions.
  2. 2Explicit serializer and cookie beans give you control over on-disk format and browser security attributes.
  3. 3Connection options like command timeouts and disconnected behavior decide how the app fails when Redis is unreachable.

Related explainers

java 
@Configuration
@EnableWebSocketMessageBroker
public class WebSocketConfig implements WebSocketMessageBrokerConfigurer {
 

Real-time chat over STOMP WebSockets in Spring

websockets stomp messaging
Intermediate 8 steps
javascript 
import { NextResponse } from 'next/server';
 
const locales = ['en', 'fr', 'de', 'es'];
const defaultLocale = 'en';

Locale routing with Next.js middleware

middleware i18n content-negotiation
Intermediate 10 steps
java 
public List<User> findUsersByEmailDomain(String domain, int minAge) {
    String sql = """
        SELECT id, username, email, age, created_at
        FROM users

Safe parameterized JDBC queries in Java

jdbc sql-injection prepared-statement
Intermediate 7 steps
java 
@Configuration
@EnableBatchProcessing
public class CustomerImportJobConfig {
 

How a chunk-based CSV import job works in Spring

batch-processing etl csv-parsing
Intermediate 9 steps
java 
@Configuration
@EnableWebSecurity
public class ResourceServerConfig {
 

Configuring a JWT resource server in Spring

oauth2 jwt authorization
Intermediate 8 steps
javascript 
const express = require('express');
const jwt = require('jsonwebtoken');
const crypto = require('crypto');
 

Refresh token rotation in Express

jwt token-rotation authentication
Advanced 9 steps

Share this explainer

Here's the card — post it anywhere.

Backing HTTP sessions with Redis in Spring — share card
Made with highlit — turn any snippet into a walkthrough like this in about a minute.
Explain your code