OutOfMemoryError in Spring Boot when server.servlet.session.timeout is set to 10 days, and storing sessions in the database slows down performance

Question

I'm running a Spring Boot application where user sessions are stored in memory by default. To keep users logged in longer, I increased the server.servlet.session.timeout property to 10 days. However, after doing this, the application frequently throws an OutOfMemoryError during peak usage.

To resolve this, I tried switching to storing sessions in a database (using Spring Session with JDBC). This solved the memory issue, but now I'm noticing a significant slowdown in application performance, especially under heavy load.

Here's a simplified version of my current setup:

server.servlet.session.timeout=10d

This led to OutOfMemoryError after a few days due to the large number of active sessions stored in memory. I switched to using Spring Session with a JDBC-based session store to offload session storage to a database:

<dependency>
    <groupId>org.springframework.session</groupId>
    <artifactId>spring-session-jdbc</artifactId>
</dependency>

spring.session.store-type=jdbc
server.servlet.session.timeout=10d

This eliminated the memory problem, but the performance of the application has degraded significantly.

Problem: While storing sessions in the database helps to avoid the OutOfMemoryError, it introduces a new bottleneck: the database accesses for session management significantly slow down the application, especially when there are high numbers of concurrent users.

Questions: Why does increasing the session timeout to 10 days lead to OutOfMemoryError in the in-memory session store?

I understand that sessions are held in memory, but how does the timeout setting affect memory consumption over time? What are the best practices for managing large session timeouts without running into memory issues?

Should I consider a hybrid solution, such as storing some data in-memory and some in the database, or is there a better approach? How can I optimize the performance of storing sessions in a database (JDBC) while maintaining a long session timeout?

Are there specific configuration tweaks, caching mechanisms, or database optimizations that could improve session read/write performance? Are there alternative solutions in Spring Boot to handle session management efficiently for long-lived sessions?

Additional Information: The application uses Spring Boot 2.5.4, and we're running on Tomcat. The database used for session storage is PostgreSQL. The application is deployed in a cloud environment, and there are around 500-1000 concurrent users during peak traffic. Any guidance on optimizing session management for long timeouts while maintaining good performance would be greatly appreciated!