play-pac4j: keep track of active sessions

What's the difference between PlayCacheSessionStore and PlayCookieSessionStore. I mean I understand that one stores data with play cache and the other stores data in cookie but I'm not sure to understand the consequences of choosing one or another.

From what I understand, PlayCacheSessionStore does manage idle timeout but PlayCookieSessionStore does not. Is there a reason why it is like this ?

Also while using using PlayCacheSessionStore in dev mode, users are logged out at every recompilation. I guess this happens because the cache is reset. Is there a way to avoid this ?

And last question : I'd like to be able to list the sessions that are currently "active". Is it possible to get such a list from PlayCacheSessionStore ? I guess this is not possible to get it from PlayCookieSessionStore because session data are not stored on the server (the whole point of cookies), right ?

What I eventually want to do is keep track of who is connected, when, from where, ... I understand this cannot be done directly with any existing SessionStore implementation and I have to persist the appropriate data somewhere (cache, cookie, database, ...)

What is the best way to do this, is there already a mechanism to do this ? (if that matters I'm using a local database to store users data (DbProfileService))

Difference between PlayCacheSessionStore and PlayCookieSessionStore

PlayCookieSessionStore: Stores session data in the cookie (client-side).

• No idle timeout (server can’t track inactivity).
• Stateless, simple, but limited size (~4KB)
• Possible security risks: Sensitive data must be signed/encrypted.
• Easy to scale (nothing stored server-side).

PlayCacheSessionStore: Stores session data in server cache.

• Supports idle timeout and forced logout.
• Requires cache backend, data lost on app restart if cache is in-memory.

Why idle timeout only with PlayCacheSessionStore?

Because cache sessions are server-side and can track last access time; cookies are client-side and stateless.

Dev mode logout on recompilation?

• Yes, in-memory cache resets on restart.
• Fix: Use persistent cache like Redis in dev.

Can you list active sessions from PlayCacheSessionStore?

• No, Play’s cache API doesn’t support listing keys.
• If you want active sessions, you must track them separately (e.g., in a database).

How to track who is connected, when, where?

You need to save session metadata (user ID, IP, login time) yourself in your DB at login and update on each request.