MongoSession should be `public`

[EugenMayer]

With #2170 MongoSession was made package private.

The problem with that is, that if someone, as we do, implements AbstractMongoSessionConverter to support custom convert implementations (for DBObject and back), it becomes no longer possible.

Interestingly AbstractMongoSessionConverter is public and abstract, so it is intended to implement it. In addition, convert is protected, not private. So it is intended that one can override it.

But due to MongoSession being package private this is no longer possible and i'am yet unware on how to workaround this limitation.

AFAIR with this new limitation spring session requires, that the MongoDB session strucuture is exactly what the developers first though of, without any ability to adopt it.

That being said, it's odd to see that at the same time AbstractMongoSessionConverter being abstract and not implementing convert at all, this detail is "left open". On can either use JacksonMongoSessionConverter or JdkMongoSessionConverter and that's about it.

Could someone explain why this limitation is important / what the rational is introducing this limitation in the first place?
Also i would love to understand why this public to package private change is by no means reflected in the https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.0-Migration-Guide#embedded-mongodb changlog guide? Is it really so unimportant?

Thank you!

[EugenMayer]

Any chance to get at least a short answer about your thoughts / plans or vision with this? would be great!

[marcusdacoregio]

Hi @EugenMayer,

I plan to review the issues in Spring Session and prioritize them in the next few weeks. It may take some time but eventually, this issue will be analyzed. I appreciate your patience.

[EugenMayer]

@marcusdacoregio is there any rough timeline on how this will be moving? The reason i ask is, this is the one blocker for us moving to sb 3.0 and right now there is no possible work-arround at all for us (besides forking, which would be a horrible option).

So having somewhat an idea here, what this is going to move to, would be awesome!

[Georglider]

@marcusdacoregio is there any rough timeline on how this will be moving? The reason i ask is, this is the one blocker for us moving to sb 3.0 and right now there is no possible work-arround at all for us (besides forking, which would be a horrible option).

So having somewhat an idea here, what this is going to move to, would be awesome!

As a workaround I use Spring 3 for the project itself and dependencies except for this one I use version 2.7. I think it's kind of a bad practice for security, but it works

[EugenMayer]

@Georglider thank you for the idea. Not an option for us here, but thank you for sharing. I assume you are also hindered by the same issue i describe above then?

[Georglider]

@Georglider thank you for the idea. Not an option for us here, but thank you for sharing. I assume you are also hindered by the same issue i describe above then?

Yes, because of this change I can't directly change attributes and hook into existing mongoIndexedSessionRepository as I did in the older version

[marcusdacoregio]

Hi @vpavic, can you provide us with some insights into those changes?

It seems to me that AbstractMongoSessionConverter is intended to be extended as mentioned in the javadoc:

Base class for serializing and deserializing session objects.
To create custom serializer you have to implement this interface and simply register your class as a bean.

There is no way to provide such an implementation with MongoSession being package-private as mentioned by the folks above.

Do you recommend any workaround or is there anything that we are missing?

[marcusdacoregio]

Hi @EugenMayer, are you able to provide more details on why you need to customize the AbstractMongoSessionConverter?

[EugenMayer]

@marcusdacoregio we moved away from MongoSession entirely due to this reasons here, so we have no need / motivated for the progress here. We planed to auther fork the mongosession part but decided that the long term effort is not worth it.

I think the reasons we had are outlined above okish, not going to dig this up 6 months later again, sorry.

Maybe someone else is a better ref for you here.

Thanks for following up