Absolute session timeouts

[sirianni]

The OWASP Session Management best practices recommend using an absolute session timeout in addition to an idle timeout.

Spring Session currently supports only inactivity timeouts. It would be nice for the library to accommodate absolute timeouts as well.

[rwinch]

@sirianni Thanks for the report. I don't think that makes sense to have every feature in Spring Session itself. There is already a Session.getCreationTime() that allows you to determine how long the session has been around. With this information, you can calculate an absolute timeout of our choice. If the timeout has occurred, you can invalidate the session.

[sirianni]

Thanks @rwinch . Do you have any initial quick thoughts on where the best place would be to wedge in this behavior?

[rwinch]

You could provide a delegating implementation of the SessionRepository interface that delegates to another implementation of SessionRepository (i.e. Redis) and then when it retrieves the session determines if the creation date is past the absolute session timeout. If it is, then you would invalidate the session and return a null value for the lookup.

[rwinch]

@sirianni You can also implement this by providing a DefaultCookieSerializer that has the maxAge property set to the absolute timeout. Keep in mind that this just removes the cookie reference after that amount of time. This means a user interacting with the application through a browser would experience it as though the session has a max expiration because the cookie would be discarded after that max timeout. However, if a malicious user got a hold of the session id, they could continue to use that session past the max expiration.

[oliversaggau]

@rwinch I tried implementing a delegating implementation like you proposed. Currently we are using Redis as a backend for storing the sessions, so we are using @EnableRedisHttpSession. But as far as I understood to provide our own (delegating) SessionRepository we would need to fall back to using @EnableSpringHttpSession and provide a Bean named sessionRepository. But how exactly are we supposed to get an instance of the RedisIndexedSessionRepository we then can delegate to? Of course I could simply create my own instance by using new RedisIndexedSessionRepository() but what about all the stuff around it like the RedisHttpSessionConfiguration.SessionCleanupConfiguration, etc.? So I basically copied the whole RedisHttpSessionConfiguration to create an instance the same way it would have been originally created. But is that really how we are supposed to do this, by copying a whole class? 🤔

[rwinch]

There are likely a lot of ways of going about this, but the easiest one that comes to mind is using a BeanPostProcessor. Something like:

public class AbsoluteSessionRepositoryBeanPostProcessor implements BeanPostProcessor {

    public Object postProcessAfterInitialization(Object bean, String beanName) {
        if (bean instanceof SessionRepository) {
           return new AbsoluteSessionRepository((SessionRepository) bean);
        }
        return bean;
    }
}

Then you need to expose the BeanPostProcessor on a @Configuration (to avoid circular bean dependencies I recommend doing this in it's own configuration with a static method).

@Configuration
public class AbsoluteSessionRepositoryBeanPostProcessorConfiguration {

    @Bean
    public static AbsoluteSessionRepositoryBeanPostProcessor AbsoluteSessionRepositoryBeanPostProcessor() {
        return new AbsoluteSessionRepositoryBeanPostProcessor();
    }
}

[oliversaggau]

It wasn't just as simply as that, but it was definitely a push in right direction for me. I had to return a CGLIB proxy in the BeanPostProcessor otherwise RedisHttpSessionConfiguration$SessionCleanupConfiguration (and maybe others) would give a BeanNotOfRequiredTypeException because the AbsoluteSessionRepository is not of type RedisIndexedSessionRepository

[gbear605]

For anyone looking at this in the future, creating this for a JdbcIndexedSessionRepository was an interesting adventure.

I first tried to use a JDK proxy, but I was getting an exception is expected to be of type 'org.springframework.session.jdbc.JdbcIndexedSessionRepository' but was actually of type 'com.sun.proxy.$Proxy411', so it seems that Spring only want to deal with cglib proxies.

Cglib requires you to pass in parameters for the constructor, or else you'll have java.lang.IllegalArgumentException: Superclass has no null constructors but no arguments were given thrown. Luckily the parameters are interfaces and Spring provides implementations that are simple to construct. I could have instead used reflection to get the objects from the existing repository, but there was no reason to do that since the superclass of the proxy is never actually used.

@Configuration
class SessionConfiguration {

	public static final Duration ABSOLUTE_SESSION_TIMEOUT = Duration.of(8, ChronoUnit.HOURS);

	/**
	 * Configures the session repository to have all sessions timeout after at least
	 * {@link SessionConfiguration#ABSOLUTE_SESSION_TIMEOUT}.
	 *
	 * Requires the session repository to be a JdbcIndexedSessionRepository.
	 */
	@Bean
	public static BeanPostProcessor absoluteSessionRepositoryBeanPostProcessor() {
		return new BeanPostProcessor() {
			@Override
			public Object postProcessAfterInitialization(@Nonnull Object bean, @Nonnull String beanName) {
				if (!(bean instanceof JdbcIndexedSessionRepository)) {
					return bean;
				}

				Enhancer enhancer = new Enhancer();
				enhancer.setSuperclass(JdbcIndexedSessionRepository.class);
				enhancer.setCallback((MethodInterceptor) (obj, method, args, proxy) -> {
					if (!method.getName().equals("findById")) {
						return method.invoke(bean, args);
					}

					Session session = (Session) method.invoke(bean, args);
					if (session == null) {
						return null;
					}

					Instant timeoutTime = session.getCreationTime().plus(ABSOLUTE_SESSION_TIMEOUT);
					if (timeoutTime.compareTo(Instant.now()) < 0) {
						return null;
					}

					return session;
				});

				return enhancer.create(
						new Class[]{JdbcOperations.class, TransactionOperations.class},
						new Object[]{new JdbcTemplate(), new TransactionTemplate()}
				);
			}
		};
	}

}