spring-session is saving session twice but spring-data-redis cannot guarantee to provide a proper result.

[ravenadesk]

I am not sure if it is a bug, but I am facing the inconsistency between the two saves of spring session when using redis with replica.
About commitSession is called twice:
commitSession() called twice

In our project, we are using redis as the storage, there is one master and two replica.
When I was testing /health endpoint with a little load, sometimes the second save cannot get the right session status (taking it as not stored in redis) throwing IllegalStateException

spring-session/spring-session-data-redis/src/main/java/org/springframework/session/data/redis/RedisSessionRepository

	@Override
	public void save(RedisSession session) {
		if (!session.isNew) {
			String key = getSessionKey(session.hasChangedSessionId() ? session.originalSessionId : session.getId());
break point		Boolean sessionExists = this.sessionRedisOperations.hasKey(key);
			if (sessionExists == null || !sessionExists) {
				throw new IllegalStateException("Session was invalidated");
			}
		}
		session.save();
	}

I have tried adding a conditional break point at the line before if condition, and let it pause a little while when key does not exist. And it turns out no problem(key exists, no exception). I have also tried that remove all my replica of redis, and there is no problem at all.
So I am wondering is this twice save patten conflict against replica synchronization of redis.

[mp911de]

Paging @vpavic

[jxblum]

@ravenadesk - This should have been an Issue ticket filed on Spring Session, first. See here.

It is true that Spring Session (common) infrastructure (for all Spring Session modules, in fact, including Redis) will save the Session twice on a SessionRepository.save(:Session), but that is by design. I don't recall all the details off the top of my head, but it appears the reference to the ticket you shared above explains this well enough.

Additionally, you must keep in mind that Redis Replication is asynchronous, between the Master and Replicas. Especially review the "Important facts about Redis replication". Therefore, any slight network issue is likely to cause a delayed synchronization and if you configured reads from replicas, then it is possible this situation might occur. I have no experience using Redis for Session management so cannot speak to the frequency of such occurrences, just that it would be possible.

It is also possible no 2 multi-node (or clustered) Redis environments supporting HA or redundancy are going to be equal in this regard. Redis Enterprise (and this), Amazon MemoryDB for Redis, and Amazon ElasticCache for Redis will offer varying level of guarantees, especially with respect to network/environment where most of these anomalies are realized.

[ravenadesk]

@mp911de @jxblum
Thank you so much. I have adjusted my config to not use read replica.