So, I would like to implement complex session management in my application. Essentially, I would like to store user sessions both in the postgre and Redis.

So, the algorithm should be the following:

1. A request is sent to the app, the application parses incoming request cookies and extracts a session parameter;

2. Spring server tries to retrieve respective session object by id from Redis

• If the previous step succeeds, then the server verifies the session and lets the request pass through if the session is active and valid. Otherwise - unauthorized path.

3. If the session object isn't present in the Redis, then the server tries pulling a member session from the postgre. Does the same verifications and caches the response. If the session isn't valid or isn't present in RDBMS - go to the unauthorized path.

Is there any elegant way to implement the following mechanism using existing packages? Or will this require custom logic?

CodePudding user response：

So, I watched this video - https://www.youtube.com/watch?v=TggWLDAXmb4

And I was able to get a gist of how basic security mechanisms work in Spring and implement the workflow described above;

Basically, you will need to have:

1. Custom security filter that will be preparing specific Authentication;
2. Custom authentication provider that will be performing authentication (checking session)