@EnableRedisHttpSession(maxInactiveIntervalInSeconds = 1800)public class SessionConfig { @Bean public LettuceConnectionFactory redisConnectionFactory() { return new LettuceConnectionFactory( new RedisStandaloneConfiguration("redis-host", 6379)); }}
Store
Detail
Redis
Most common; TTL via EXPIRE
Memcached
Volatile; LRU eviction
DynamoDB
Managed, TTL items
5. Implementing Token-Based Sessions (JWT)
Part
Content
Header
{"alg":"RS256","typ":"JWT"}
Payload
Claims: sub, exp, iat, aud, custom
Signature
HMAC or asymmetric
Storage
Cookie (HttpOnly, Secure, SameSite) or Authorization header
Revocation
Short TTL + refresh token; or revocation list
Warning: Never store secrets in JWT payload — it's only base64-encoded, not encrypted. Use JWE for confidentiality.