Supporting multiple sessions per browser by incorporating a custom HTTP header

Question

In this article, it explains how Spring Session supports multiple sessions for one browser by incorporating a second identifier. It seems by default this identifier is called _s and it's a query string in the request's URL.

I'm trying to implement the exact same thing but instead of a query string, I would like to use a custom HTTP header. And I'm kinda new to the whole idea, could someone please tell if this is possible and where to start?

Answer 1

The query string parameter _s is used to locate the session to use for a given request. In the official documentation, this parameter is referred to as the session alias parameter.

If you go through the source code for Spring Session, you will notice that the task of extracting the session alias parameter is delegated to the HttpSessionManager interface. In the current code base, this interface has only one implementation - CookieHttpSessionStrategy, which extracts the parameter from the query string (see line 183 in the linked source code).

Therefore, there is no way to extract the parameter value from an HTTP header with the current implementation (since the only available implementation can only extract it from the query string).

However, you could subclass CookieHttpSessionStrategy, override the getCurrentSessionAlias method to extract the parameter from the headers and override the default session strategy for your application as:

@Bean
public HttpSessionStrategy httpSessionStrategy() {
  return new MyHttpSessionStrategy();
}

where, MyHttpSessionStrategy is the custom strategy you have written.