<p>I have a Spring Boot (1.5.8) webapp, with several other Spring Boot services, all deployed to AWS. The webapp module is deployed to two EC2 instances managed by an Elastic Load Balancer. The whole system is orchestrated by Kubernetes.</p>

<p>I'm trying to set the session cookie max age to work around a problem, as suggested here: <a href="https://stackoverflow.com/questions/48756986/spring-saml-endless-redirect-loop-after-a-successful-authentication">Spring-SAML Endless redirect loop after a successful authentication</a></p>

<p>When I run on my local machine using Docker Compose, all I do is set <code>server.session.cookie.max-age</code> in the webapp's <code>application.yml</code> and it works. </p>

<p>The same thing doesn't work in the Kubernetes-managed system. The webapp has an env actuator endpoint set up and I can see that the max-age setting was applied, but the cookie still has "session" expiration. </p>

<p>The session cookie is named <code>JSESSIONID</code> on my local machine, but just <code>SESSION</code> on the Kubernetes cluster. Why is that? Is the session cookie managed at some higher level in that system, like by the load balancer or Kubernetes itself? I'm pretty lost at this point, so any suggestions would help. </p>

Greg Charles
<p>OK, it turned out that the session is being managed by Spring due to <code>spring.session.store-type</code> being set to <code>redis</code> in the integration environments. It's <code>none</code> in my local build, which means Tomcat manages the session instead. Sorry, I didn't mean to obfuscate that. I just didn't know what to look for. The default session cookie name for a Spring-managed session is <code>SESSION</code>, while for Tomcat, it's <code>JSESSIONID</code>, so I was at least right about that being the key to the mystery.</p>

<p>There don't seem to be properties for configuring the Spring session cookie, but I found this explanation about how to configure it in code: <a href="https://docs.spring.io/spring-session/docs/current/reference/html5/guides/java-custom-cookie.html" rel="nofollow noreferrer">Spring Session - Custom Cookie</a></p>
