Welcome
Sign in to start your session
Login
Login
[app info]
Brief app info: ENV: [DEV] commitId: b5855482303bbc4485b9312bb01ab6851fa558a2 branch: develop build date: 2026-09-08T10:04:00Z build version: 2026.08.06.1-SNAPSHOT commit message: #38385 Tolerate old Redis sessions across the SB3 cutover and confine Spring Session to site-api The prod SB3 rollout (Boot 2.7/Security 5.7 -> 3.2/6.2) turned every request carrying a pre-deploy SESSION cookie into a 500: Spring Security stamps its serializable types with SpringSecurityCoreVersion.SERIAL_VERSION_UID (570 vs 620), so sessions the old build wrote to Redis failed deserialization in SessionRepositoryFilter before any controller. The field layouts are identical between the two versions - only the stamp differs. - site-api: new springSessionDefaultRedisSerializer (SecurityVersionTolerantRedisSerializer) reads a session whose org.springframework.security.* descriptor carries a different serialVersionUID by substituting the local descriptor. Scoped to that package so a real layout change in our own classes still fails loudly; anything else unreadable is logged and returned null (degrade to anonymous, not 500). New sessions are written with ordinary serialization. - Confine Spring Session to site-api. spring-session-data-redis is a global dependency and Boot 3 ignores store-type: none, so any module with a RedisConnectionFactory would auto-start a Redis session store. Exclude SessionAutoConfiguration in platform-api, tournaments-core, messaging, marketing-subsystem and scheduler (admin already did); bring postback-bridge in line with its siblings (RedisAutoConfiguration + Session excludes). - Remove the dead redisObjectTemplate bean, the only JDK value serializer for Redis, which had no consumers. - Tests: SecurityVersionTolerantRedisSerializerTest forges a 5.7-stamped stream (stock serializer throws, ours reads); RedisSessionDisabledITTest asserts online-scheduler, which does have a RedisConnectionFactory, exposes no SessionRepository. Prod stop-gap until deploy: delete PROD:spring:session:* (one forced logout). After deploy the shim reads old sessions. UPTIME: 0d 5h 5m 31s Git log: a929d... | 2026-09-08T10:34:22+03:00 | Rodion | #37354 Align the chain-builder hint test with t... c574c... | 2026-09-08T09:30:40+03:00 | Rodion | #38371 Merge branch 'fix/38371' into develop fd47a... | 2026-09-07T19:24:05+03:00 | Rodion | #38371 Make KafkaRecoveryService the single poi... 0642c... | 2026-09-07T17:37:06+02:00 | nikita | #37354 5dd5c... | 2026-09-07T16:48:32+02:00 | nikita | #37354 5eefb... | 2026-09-07T16:15:54+02:00 | nikita | #37354 da607... | 2026-09-07T15:21:56+02:00 | nikita | #37354 5cafd... | 2026-09-07T13:53:16Z | Rodion Besedin | Merge branch '38195_4' into 'develop' 3abbc... | 2026-09-07T13:53:16Z | Vladyslav Ma... | #38195 Point the promotion menu and list at the... 83d61... | 2026-09-07T11:51:31Z | Rodion Besedin | Merge branch '38306' into 'develop'
copy to clipboard
