CODEWITHSUNDEEP
sessionoauth-2.0microservicesspring-security-oauth2spring-data-redis
eray
eray

Reputation: 113

Where to manage session in microservices architecture with Spring Boot

I am fairly new in microservices architecture. I've been trying to build a microservices stack using Spring Boot, Spring Cloud and Netflix OSS libraries. I want to know what is the correct way and place to store session.

Here is an overview of the infrastructure that I created:

  1. OAuth2 backed Authorization/Authentication Server
  2. UI Service (Spring Boot, Front end service)
  3. Backend Service-1
  4. Backend Service-2
  5. Redis Server to store session and other cachable data
  6. Discovery Server (eureka)

Currently, I'm trying to store session in Redis by configuring UI service to perform it. It seems to be working fine, although I haven't had the chance to try it for multiple service instances. However, I'm already having serialization/deserialization issues while developing. By the way, trying to store the session on front end app is the correct place to do or it should be done in Authorization/Authentication service as authentication is processed in that service?

Here is my Session config in UI service (front end service)

@Configuration
@EnableRedisHttpSession
public class SessionConfig extends 
AbstractHttpSessionApplicationInitializer {

    public SessionConfig() {
        super(RedisConfig.class);
    }
}

To sum up, I'm expecting to achieve and use best practices on this project. Your kind assistance would be appreciated.

Upvotes: 6

Views: 12849

Answers (1)

Oswin Noetzelmann
Oswin Noetzelmann

Reputation: 9545

The idea of a general server side user session and a microservices style architecture don't go together well. The reason being that you are likely to break the separation of concern that you use separate the domain boundaries of your services.

Remember, every service is supposed to service a specific domain problem autonomously - including all required data persistence. So for example if there is anything to remember for a users connected devices you would do that in the one service that is responsible for those device connections and nowhere else. The service would be responsible for processing those request and persisting any status that the devices require. Similarly when there is anything to remember about he users authorization you would do that in the authorization service.

And regarding the question to use Redis or not - In a microservices architecture the choice of storage system would be up to the service architect. Maybe one service stores its data in a relational database, maybe another uses a key-value-store and yet another may use an event queue system or a time series database.

So in summary you have to ask yourself what your session really is used for and make the corresponding services responsible to persist that information in a domain specific way. (If you give some more details in your question about this, I can give you my opinion).

Upvotes: 6

Related Questions