Spring Session principal index: invalidate one operator's sessions safely

Choose the indexed repository deliberately

The basic Redis session repository can look up a session by ID but does not provide principal search. An indexed repository supports findByPrincipalName and adds index maintenance. Use it when a parcel-console administrator must revoke all sessions after a credential reset. Shared session storage alone does not create that search capability.

Check ownership before deletion

For a self-service device logout, first list sessions for the authenticated principal, then delete only an ID found in that set. A global administrator action needs a separate authorization check and audit record. Expiration and index events also need operational testing, especially with clustered Redis, because stale index entries can remain even when a session has expired. Method authorization should guard the action, not the UI button alone.

Prove revocation

Log the same operator into two browsers, revoke one session, and confirm the other still works. Then revoke all sessions after a credential reset and confirm both fail on the next request. This sketch is only a repository selection; it does not implement the administrative endpoint or its audit trail.

Implementation sketch

spring:
  session:
    redis:
      repository-type: indexed
      namespace: parcel-console:session

Cost and verification

Principal indexes add Redis writes and keys. Plan cleanup, expiration checks and bounded administrative lookups for accounts with many sessions.

Common Mistakes

• Do not call findByPrincipalName on a repository configured without indexing.
• Do not delete a user-supplied session ID before checking it belongs to the intended principal.
• Do not assume an expired index entry proves an active session exists.

Read next

Spring Session Redis across replicas: shared login state has a Redis failure boundary, Spring Security login session: rotate the identifier at authentication, Spring method authorization: test the proxied service boundary, Spring Security OAuth2 login: callback, identity and browser session.