How do you handle session management in Spring Boot?

Question

Accepted Answer

Session management in Spring Boot is typically delegated to Spring Session, which externalizes HTTP session storage so it works consistently across single-instance and distributed deployments.

Key Points:
• Add the Spring Session starter along with a backing store dependency (Redis, JDBC, or Hazelcast).
• Configure the store's connection in application.properties/yml; Spring Session then transparently replaces the servlet container's default session handling.
• Integrates with Spring Security so authenticated session state is also externalized.
• In a distributed system, this ensures a user isn't tied to the specific server instance that first handled their request.
• Session timeout, cookie name, and serialization can all be tuned via spring.session.* properties.

Example:
Without Spring Session, a session created on server A is lost if a later request lands on server B; with Redis-backed Spring Session, both servers read the same session data, so the user experience stays seamless.

Code Example:
```
# application.properties
spring.session.store-type=redis
spring.session.timeout=1800
spring.data.redis.host=redis.internal
spring.data.redis.port=6379
```

Interview Tip:
A concise interview answer is:

"I use Spring Session with a shared store like Redis so session state lives outside any single instance. After adding the dependency and pointing it at the store in configuration, it integrates with Spring Security automatically, which keeps sessions consistent across a load-balanced or distributed deployment."