0

I am using Spring Cloud Gateway with @EnableSpringWebSession functionality. The session can be configured with a max inactivity interval which when it's reach will end the session.

Is there a way to black list some of the urls from marking session as active?

Our use case is as follows: We integrate a third party component, that for it's internal purpose sends a heartbeat every 5 sec. But from our point of view it's not a user activity and we don't want to refresh the session on these calls. Is there a way to instruct Spring not to thread this call as session activity?

julew
  • 216
  • 3
  • 14
  • 1
    There is nothing available out of the box. The simplest way is if the heartbeat is not tied to a user, then you should avoid accessing the `HttpSession` and the timeout will not be extended. You can turn on debug logs to see when the `HttpSession` is accessed. You can find similar discussions in this [SO question](https://stackoverflow.com/questions/66780831/spring-boot-exclude-url-to-prevent-maitaining-the-session-timeout) and this [GitHub issue](https://github.com/spring-projects/spring-session/issues/244). – Eleftheria Stein-Kousathana Jul 06 '21 at 11:58
  • Actually I want the heartbeat to be done within the session, but not refreshing it. The only solution that comes to my mind currently is to maintain manually a separate session timeout in session data. – julew Aug 25 '21 at 08:12

0 Answers0