I’m working on a Spring Auth Server.
I’m having problems setting Cookie parameters though, where they are not being set.

Here is my server log:

SESSION INFORMATION - AFTER SUCCESSFUL AUTHENTICATION
Session ID: 2E39E82F4C8014418E584564F5B4CE2E
Session Creation Time: 2024-08-11T09:07:30.655Z
Session Last Accessed Time: 2024-08-11T09:07:30.655Z
Session Timeout (seconds): 5
Session Expiration Time: 2024-08-11T09:07:35.655Z
-----------
SESSION COOKIE INFORMATION
Cookie Name: null
Cookie Path: null
Cookie Domain: null
Cookie Max Age: -1
Cookie Secure: false
Cookie HttpOnly: false
Cookie Attributes: {}
-----------
RESPONSE COOKIES INFORMATION
Cookie Name: JSESSIONID
Cookie Value: 2E39E82F4C8014418E584564F5B4CE2E
Path: /
Domain: null
Max-Age: null
Expires: null
Secure: false
HttpOnly: true
SameSite: null

The Response Cookie (JSESSIONID) is what I believe the Auth Server sets after each Session is created. The code that generates the above log information are in the Success and Failure handlers (see below)

Cookie Config

My Config Cookie Code looks like this (following the docs here: https://docs.spring.io/spring-session/reference/configuration/common.html#customizing-session-cookie):

@Configuration
internal class CookiesConfig(
    private val sessionProperties: SessionProperties
) {

    @Bean
    fun cookieSerializer(): CookieSerializer {
        val serializer = DefaultCookieSerializer()
        serializer.setCookieName(sessionProperties.SESSION_COOKIE_NAME)
        serializer.setUseHttpOnlyCookie(sessionProperties.SESSION_COOKIE_HTTP_ONLY)
        serializer.setUseSecureCookie(sessionProperties.SESSION_COOKIE_SECURE)
        serializer.setSameSite(sessionProperties.SESSION_COOKIE_SAME_SITE)
        serializer.setCookieMaxAge(sessionProperties.SESSION_COOKIE_MAX_AGE)
        serializer.setCookiePath(sessionProperties.SESSION_COOKIE_PATH)
        return serializer
    }

}

Parameters

The parametes are set here (all my properties are in a file Application Properties):

@Component
internal class SessionProperties {

        final val SESSION_MAX_AGE: Int = 5 // in seconds

        final val SESSION_COOKIE_NAME: String = "AUTH-SESSIONID"

        final val SESSION_COOKIE_HTTP_ONLY: Boolean = true
        final val SESSION_COOKIE_SECURE: Boolean = false // scope is not just on secure connections
        final val SESSION_COOKIE_SAME_SITE: String = "Strict"
        final val SESSION_COOKIE_MAX_AGE: Int = 5 // in seconds
        final val SESSION_COOKIE_PATH: String =  "/"

        final val REDIRECT_URL: String = "/session-expired"
}

Repository files

The relevant files for setting cookie information are:

Application Properties
See Session Properties

Cookie Config

Success Handler

Failure Handler

Main Security chain

Should CookieSerializer into the main security chain somewhere, for this synchronous Auth server? It seems like it’s being totally ignored. Even the name I set “AUTH-SESSIONID” is being ignored.

Here is my main security chain config:

Security Chain Configuration

Can someone please help?

Once I get this working, I was hoping to migrate all the in-memory storage to Spring Session and Redis.