Spring Boot with AngularJS form authentication leveraging Spring Session

In this blog post I would like to show you how you can distribute the session on Heroku via Spring Session. In order to get started quickly I am using Dave Syer's code from the II part of the awesome "Spring and Angular JS" blog series. I highly recommend to read them.

I did some modifications to the initial code, like using npm and bower instead of wro4j to manage front end dependencies. If you would like to jump right to the code, you can find it here.

The http sessions will be stored in a Redis instance, which all web dynos will have access to. This enables to deploy the web application on multiple dyno's and the login will still work. Heroku has a stateless architecture where the routers use a random selection algorithm for HTTP request load balancing across web dynos, there is no sticky session functionality.
I chose Redis Cloud service on Heroku since it gave me a 25MB free data plan. After adding

heroku addons:add rediscloud

The REDISCLOUD_URL environment is available where the connection settings are provided as seen below.



The BUILDPACK_URL was used to configure a multipack build using this library. Basically it allowed to run first the npm install and then the ./gradlew build command.
Via the embedded-redis library it is possible to start a redis server during initialisation. The related Redis configuration can be found below

	package demo;
	import org.springframework.beans.BeansException;
	import org.springframework.beans.factory.DisposableBean;
	import org.springframework.beans.factory.InitializingBean;
	import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
	import org.springframework.beans.factory.support.BeanDefinitionRegistry;
	import org.springframework.beans.factory.support.BeanDefinitionRegistryPostProcessor;
	import org.springframework.context.annotation.Bean;
	import org.springframework.context.annotation.Configuration;
	import org.springframework.data.redis.connection.jedis.JedisConnectionFactory;
	import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;
	import org.springframework.session.web.context.AbstractHttpSessionApplicationInitializer;
	import redis.clients.jedis.Protocol;
	import redis.embedded.RedisServer;
	@Configuration
	@EnableRedisHttpSession
	@Development
	public class EmbeddedRedisConfiguration {
	@Bean
	public JedisConnectionFactory connectionFactory() {
	return new JedisConnectionFactory();
	}
	@Bean
	public static RedisServerBean redisServer() {
	return new RedisServerBean();
	}
	static class Initializer extends AbstractHttpSessionApplicationInitializer {
	public Initializer() {
	super(EmbeddedRedisConfiguration.class);
	}
	}
	/**
	* Implements BeanDefinitionRegistryPostProcessor to ensure this Bean
	* is initialized before any other Beans. Specifically, we want to ensure
	* that the Redis Server is started before RedisHttpSessionConfiguration
	* attempts to enable Keyspace notifications.
	*/
	static class RedisServerBean implements InitializingBean, DisposableBean, BeanDefinitionRegistryPostProcessor {
	private RedisServer redisServer;
	public void afterPropertiesSet() throws Exception {
	redisServer = new RedisServer(Protocol.DEFAULT_PORT);
	redisServer.start();
	}
	public void destroy() throws Exception {
	if(redisServer != null) {
	redisServer.stop();
	}
	}
	public void postProcessBeanDefinitionRegistry(BeanDefinitionRegistry registry) throws BeansException {}
	public void postProcessBeanFactory(ConfigurableListableBeanFactory beanFactory) throws BeansException {}
	}
	}

view raw EmbeddedRedisConfiguration.java hosted with ❤ by GitHub

Running on Heroku we needed another Redis configuration which connects to the previously defined Redis Cloud service.

	package demo;
	import org.springframework.context.annotation.Bean;
	import org.springframework.context.annotation.Configuration;
	import org.springframework.context.annotation.Profile;
	import org.springframework.data.redis.connection.jedis.JedisConnectionFactory;
	import org.springframework.session.web.context.AbstractHttpSessionApplicationInitializer;
	import java.net.URI;
	import java.net.URISyntaxException;
	@Profile("production")
	@Configuration
	@EnableRedisHttpSession
	public class ProductionRedisConfiguration {
	@Bean
	public JedisConnectionFactory connectionFactory() throws URISyntaxException {
	JedisConnectionFactory redis = new JedisConnectionFactory();
	String redisUrl = System.getenv("REDISCLOUD_URL");
	URI redisUri = new URI(redisUrl);
	redis.setHostName(redisUri.getHost());
	redis.setPort(redisUri.getPort());
	redis.setPassword(redisUri.getUserInfo().split(":",2)[1]);
	return redis;
	}
	static class Initializer extends AbstractHttpSessionApplicationInitializer {
	public Initializer() {
	super(ProductionRedisConfiguration.class);
	}
	}
	}

view raw ProductionRedisConfiguration.java hosted with ❤ by GitHub

You can connect to the Redis cloud service also from your localhost via

redis-cli -h hostname -p port -a password

And you will see the created keys which correspond to the value of your SESSION cookie.
Try to increase the dynos for your web application and you will see the login will still work.