title: Hazelcast + spring security + distributed sessions = how to make it work?
body: <p>Being inspired by <a href="http://docs.hazelcast.org/docs/latest/manual/html/websessionreplication.html" rel="nofollow">http://docs.hazelcast.org/docs/latest/manual/html/websessionreplication.html</a> I decided to give it a try and use in my Spring MVC + Security application.</p>
  
  <p>First issue I hit is - Hazelcast was complaining it can't find <code>sessionRegistry</code> bean. I solved it pretty quickly by adding following bean to spring-security context</p>
  
  <pre><code>&lt;bean id="sessionRegistry"
      class="org.springframework.security.core.session.SessionRegistryImpl" /&gt;
  </code></pre>
  
  <p>But I hit next issue right away and still can't solve it. 
  This is what happens:</p>
  
  <ol>
  <li>Start tomcat (assuming app will be started as well)</li>
  <li>Login to site - ok</li>
  <li>Logout - ok (<strong>CONCERN</strong>: logged out ok, <code>JSESSIONID</code> and <code>REMEMBER_ME_TOKEN</code> cookies are cleared, but <code>hazelcast.sessionId</code> cookie is <strong>NOT</strong> cleared)</li>
  <li>Restart tomcat</li>
  <li>Navigate to index page</li>
  <li><strong>ERROR</strong>: Infinite redirects to <code>invalidSessionStrategy</code> happens</li>
  </ol>
  
  <p>After some debugging I found several facts:</p>
  
  <ul>
  <li>it happens because inside <code>SessionManagementFilter#doFilter</code> check for <code>request.isRequestedSessionIdValid()</code> returns <code>false</code></li>
  <li><code>JSESSIONID</code> and <code>hazelcast.sessionId</code> are different (which is I assume by design)</li>
  <li>looks like issue happens because of inconsistency between calls <code>request.isRequestedSessionIdValid()</code> and <code>request.getSession()</code> - looks like if former returns <code>false</code>, then latter suppose to create new session - which doesn't happen</li>
  </ul>
  
  <p>What I tried so far (and it didn't help):</p>
  
  <ul>
  <li>manually clear <code>hazelcast.sessionId</code> cookie using buildin spring security logout handler (no success, coockie appears again with same value)</li>
  <li>workaround <a href="https://github.com/hazelcast/hazelcast/issues/3049" rel="nofollow">https://github.com/hazelcast/hazelcast/issues/3049</a> which is about sending <code>HttpSessionDestroyedEvent</code> on logout. No effect was noticed</li>
  <li>tried ti use <code>JSESSIONID</code> as session id for hazelcast cookie name (in that case I can open ap only once, all subsequent requests result in infinite redirects to <code>invalid-session</code>)</li>
  </ul>
  
  <p>So... Apparently it's not that simple as stated in official Hazelcast docs. Any ideas how to make it work?</p>