Comment by Jan Vladimir Mostert on "Spring boot session restarting"

Jan Vladimir Mostert

Idea Incubator

May 12, 2016

Your session will be killed by design when you restart the server, hence the reason your Session Scope also disappears.

There are multiple ways to fix this, the best ones I can think of are:

either change your system so that you are mostly stateless and generating your own tokens so that you don't have to rely on a session (sessions are horrible when you need to do load balancing)
use Spring Loaded or Jrebel so that you don't have to restart.

I've recently switched from Spring Loaded to Jrebel and have already prevented over 600 restarts in the last month. For simple projects Spring Loaded was fine, but having many libraries depending on many other libraries, Jrebel can reload those libraries inside your running projects as well which Spring Loaded failed to do.

Rafael Zomer Antunes

Fullstack Developer

May 12, 2016

Ah, sorry, i'm already using Spring Loaded, but 70% of times that i try compile the code the server crashes, and i need restart it, when i do it my session loses it scope and i need login again. So i have some easy way to do the first option? (you have a basic example or something like?)

(Jrebel isn't a option, so expensive =x)

What causes the server to crash? I do about 10-30 redeploys a day and maybe a single Jetty restart every 3 days on Jrebel, on Spring Loaded I also hardly ever had to restart anything.

I don't know if there's an easy option to make your system stateless, as far as I know Spring Security prefers sessions, so either you rip out Spring Security to roll your own tokens or override Spring Security's login mechanism so that it will pull tokens from a Secure HTTP-only cookie and then you have to make sure that your token is included in every GET / POST / PUT / DELETE - a lot of custom work.

Have a look at some of my stackoverflow posts from last year when I too was trying to get rid of sessions:

So short answer, getting rid of sessions will require quite a bit of custom work which may even introduce security holes if you don't implement it correclty; fixing the crashing server might be the easier way to go.

Search Hashnode