spring - 存储在 Spring (HTTP) Session 中的数据在销毁期间不会从 Redis 中删除

Question

我正在使用新发布的 Spring Session 组件进行 PoC。这是由 Redis 存储库备份的， session 和存储在 session 中的对象/数据都保存到该存储库。

1. 在应用程序中创建了 session
2. 在 Redis CLI 中运行“Keys *”命令并看到一个新条目(如“spring:session:sessions:6b55103a-baf5-4a05-a127-3a9cfa15c164”)
3. 从应用程序中，向 session 添加了一个自定义 bean
4. 在 Redis CLI 中运行“Keys *”命令，看到了一个新条目这个 bean(比如 "\xac\xed\x00\x05t\x00\tcustomer1"，因为bean 有一个值为“customer1”的字符串)
5. 我已将应用程序配置为 30 秒自动过期，并在这段时间内未使用该应用程序
6. sessionDestroyEvent 被触发并在实现 ApplicationListener 的监听器中被捕获
7. 在 Redis CLI 中运行“Keys *”命令，现在第一个创建 session 条目已消失，但是自定义 bean 对象(customer1) 仍然留在 Redis 中

问题:

Is it the user responsibility to clean-up the Redis Store ? If i had many data elements stored in my session, should i have to manually clean them up from the redis store during session destroy (logout and timeout events).

更新:

While i posted this question and went back (probably after 3/4 mins) to Redis-CLI to list the Keys, now i do not find the Customer1 object. So does that mean the clean-up is performed by Redis on some regular interval, like the Garbage collection ?

Answer 1

Session Expiration section Spring Session reference详细描述了 session 是如何清理的。

来自文档:

One problem with this approach is that Redis makes no guarantee of when the expired event will be fired if they key has not been accessed. Specifically the background task that Redis uses to clean up expired keys is a low priority task and may not trigger the key expiration. For additional details see Timing of expired events section in the Redis documentation.

...

For this reason, each session expiration is also tracked to the nearest minute. This allows a background task to access the potentially expired sessions to ensure that Redis expired events are fired in a more deterministic fashion.