Allow configuring default maxIdleTime on InMemoryWebSessionStore

[Mehdi-HAFID]

Allow configuring default maxIdleTime on InMemoryWebSessionStore

Summary

Currently, there is no way to configure a default maxIdleTime for WebFlux sessions when using InMemoryWebSessionStore. This leads to the need to inject a WebFilter to manually set the idle timeout on every request:

@Bean
public WebFilter sessionTimeoutWebFilter() {
    return (exchange, chain) -> exchange.getSession()
        .doOnNext(session -> session.setMaxIdleTime(Duration.ofHours(12)))
        .then(chain.filter(exchange));
}

This approach works, but it adds unnecessary overhead per request and is not as clean as setting a global configuration once.

Proposal

It would be beneficial to expose a method such as:

public void setDefaultMaxIdleTime(Duration maxIdleTime);

on InMemoryWebSessionStore, allowing a more declarative and efficient way to configure session expiration behavior.

Use Case

In our application (Spring Boot 3.5.3), we rely on sessions to store OAuth2AuthorizedClients for TokenRelay. We want the session idle timeout to match our access token TTL (e.g., 12 hours). Without global configuration support, this requires a workaround via filter.

Related Issues

• Support for Spring WebSession lifecycle tracking #28164

Environment

• Spring Framework: 6.2.8
• Spring Boot: 3.5.3
• Web stack: Spring WebFlux