HTTP 세션 수명 주기

package board.web.auth;

import java.util.Optional;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpSession;

public final class SessionMemberReader {
    public static final String AUTHENTICATED_MEMBER_ATTRIBUTE =
            "authenticatedMember";

    public Optional<AuthenticatedMember> read(
            HttpServletRequest request
    ) {
        HttpSession session = request.getSession(false);
        if (session == null) {
            return Optional.empty();
        }
        Object value = session.getAttribute(
                AUTHENTICATED_MEMBER_ATTRIBUTE);
        if (value instanceof AuthenticatedMember member) {
            return Optional.of(member);
        }
        return Optional.empty();
    }

    public record AuthenticatedMember(long id) {
        public AuthenticatedMember {
            if (id <= 0) {
                throw new IllegalArgumentException("positive member id required");
            }
        }
    }
}

package board.web.post;

import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.SessionAttribute;

import board.web.auth.SessionMemberReader;
import board.web.auth.SessionMemberReader.AuthenticatedMember;

@Controller
public final class PostPageController {
    @GetMapping("/posts")
    String sessions(
            @SessionAttribute(
                    name = SessionMemberReader.AUTHENTICATED_MEMBER_ATTRIBUTE,
                    required = false)
            AuthenticatedMember member,
            Model model
    ) {
        if (member == null) {
            return "redirect:/login";
        }
        model.addAttribute("memberId", member.id());
        return "posts/list";
    }
}

package board.web.auth;

import java.util.EnumSet;

import jakarta.servlet.SessionTrackingMode;

import org.springframework.boot.web.servlet.ServletContextInitializer;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration(proxyBeanMethods = false)
public class SessionTrackingConfiguration {
    @Bean
    ServletContextInitializer cookieOnlySessionTracking() {
        return servletContext -> servletContext
                .setSessionTrackingModes(
                        EnumSet.of(SessionTrackingMode.COOKIE));
    }
}

package board.web.auth;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;

import org.springframework.http.ResponseCookie;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.PostMapping;

@Controller
public final class LogoutController {
    @PostMapping("/logout")
    String logout(
            HttpServletRequest request,
            HttpServletResponse response
    ) {
        HttpSession session = request.getSession(false);
        if (session != null) {
            session.invalidate();
        }
        ResponseCookie expired = ResponseCookie.from("JSESSIONID", "")
                .httpOnly(true)
                .secure(true)
                .sameSite("Lax")
                .path("/")
                .maxAge(0)
                .build();
        response.addHeader("Set-Cookie", expired.toString());
        return "redirect:/";
    }
}

server.servlet.session.timeout=30m
server.servlet.session.cookie.http-only=true
server.servlet.session.cookie.secure=true
server.servlet.session.cookie.same-site=lax
spring.servlet.multipart.max-file-size=5MB
spring.servlet.multipart.max-request-size=6MB

package board.web.auth;

import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatThrownBy;

import org.junit.jupiter.api.Test;
import org.springframework.mock.web.MockHttpServletRequest;

class SessionLifecycleTest {
    @Test
    void session은_명시한_idle_timeout과_폐기_신호를_가진다() {
        var request = new MockHttpServletRequest();
        var session = request.getSession(true);
        session.setMaxInactiveInterval(1_800);
        session.setAttribute(
                SessionMemberReader.AUTHENTICATED_MEMBER_ATTRIBUTE,
                new SessionMemberReader.AuthenticatedMember(41L));

        assertThat(session.getMaxInactiveInterval()).isEqualTo(1_800);
        assertThat(session.getAttribute(
                SessionMemberReader.AUTHENTICATED_MEMBER_ATTRIBUTE))
                .isEqualTo(new SessionMemberReader.AuthenticatedMember(41L));

        session.invalidate();

        assertThatThrownBy(session::getCreationTime)
                .isInstanceOf(IllegalStateException.class);
    }
}

created = true
idle timeout = 1800 seconds
authenticated member = 41
invalidate executed = true
subsequent access = IllegalStateException