What happen if there are too many session in the spring-mvc + tomcat application - spring

Question

I am having a project using spring-mvc + tomcat. It has a keycloak adapator and a CMS systems which use the traditional session to manage the user login,
i.e. the spring-mvc checks if the session has permission, and if not it will redirect to keycloak login page.
I need to write some new routes (RESTful, using #RestController) for their new mobile app. These api will accept the access_token and return data if they have permission/ the token is valid.
Because this backend needs to also support the old CMS system, so I can't set the spring to stateless or disable the session usage.
As I am not in controll of who is using these new RESTful API, some api users are just calling these api without passing the session cookies, so that the backend makes a new session for them every time they called (these api will be called very frequently to update the data, say 30 every mins)
So, will the server having memory usage problem if there are too many sessions? I know that the default of session timeout should be 30mins, is this timeout enough?. I have done a lot of searching but seems no one talks about this

Answer 1

Each session will consume some memory, to the total needed memory for sessions is number of sessions (in parallel) x size per session. - I know this is not helpful, so the help full part comes next.
If you have many (huge) sessions, Tomcat can persist them on disk, instead of hold them in memory. You just need to configure an other Manger Implementation for sessions: switch to org.apache.catalina.session.PersistentManager and you need to configure the idle parameters: https://tomcat.apache.org/tomcat-9.0-doc/config/manager.html
Important: all the stuff that is stored in your session must be Serializable!.

Answer 2

I finally figured out a way to actually enables sessions in routes for web cms while disabling sessions on RESTful routes, i will post it here
you can define a MultiHttpSecurityConfig
#Configuration
public class MultiHttpSecurityConfig{
#KeycloakConfiguration
#Order(1)
public class SecurityConfig1 extends KeycloakWebSecurityConfigurerAdapter
{
/**
* Registers the KeycloakAuthenticationProvider with the authentication manager.
*/
#Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(keycloakAuthenticationProvider());
}
/**
* Defines the session authentication strategy.
*/
#Bean
#Override
protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
return new NullAuthenticatedSessionStrategy();
}
#Override
protected void configure(HttpSecurity http) throws Exception
{
super.configure(http);
http.antMatcher("/api/v1/external/**") // these routes disabled session
.authorizeRequests()
.anyRequest()
.permitAll()
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
}
#KeycloakConfiguration
#Order(2)
public class SecurityConfig2 extends KeycloakWebSecurityConfigurerAdapter
{
/**
* Registers the KeycloakAuthenticationProvider with the authentication manager.
*/
#Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(keycloakAuthenticationProvider());
}
/**
* Defines the session authentication strategy.
*/
#Bean
#Override
protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
return new RegisterSessionAuthenticationStrategy(buildSessionRegistry());
}
#Bean
protected SessionRegistry buildSessionRegistry() {
return new SessionRegistryImpl();
}
#Override
protected void configure(HttpSecurity http) throws Exception
{
super.configure(http);
http
.antMatcher("/")
.authorizeRequests()
.anyRequest().permitAll();
}
}
}