javaspringspring-bootspring-session

Session not persisted between Spring Boot (Spring Session + MySQL) and Angular frontend


I am using Spring Boot 2.7.18 with Spring Session and MySQL to store sessions in the database, and my frontend is built with Angular. After logging in and being redirected back to my Angular app, the session ID changes, and a new session is created in both the browser (under the "Application" tab) and the MySQL database. This happens even though I expect the same session to persist between requests, causing the session to be recreated every time the user is redirected, which breaks session persistence.

Flow overview:

  1. The user clicks a button in the Angular app.
  2. The button triggers an OIDC authentication page.
  3. The user connects via one of the available options.
  4. The user is redirected to an endpoint in my Spring Boot app.
  5. The Spring Boot app redirects the user back to my Angular app.

so at the first step, there is a certain session id, then at the last, this id changed. I don't understand why, or if we i'm trying is possible.


Solution

  • Changing the sessionId upon authentication is a common practice to prevent session fixation attacks. Spring Security has support for configuring the behavior. By default it should keep the session contents, but change the sessionId.