Cannot serialize session attribute SPRING_SECURITY_CONTEXT for session

Question

Environment : Tomcat 6, Java 6 , Redis and spring security-3.1.4

I try to cluster tomcat by adding user sessions to Redis cache. I have copied tomcat-redis- session-manager-1.2-tomcat-6.jar and jedis-2.0.0.jar to tomcat lib and added below config to tomcat context.xml.

Everything working fine. But I am getting bellow exception when i try to log-in to the system.

It seems there is an spring security context attribute which is contains non serializable attribute. Please help to resolve this issue.

context.xml

 <Valve className="com.radiadesign.catalina.session.RedisSessionHandlerValve" />
 <Manager className="com.radiadesign.catalina.session.RedisSessionManager"
     host="127.0.0.1"
     port="6379"
     database="0"
     maxInactiveInterval="60" />



   org.apache.catalina.session.StandardSession writeObject
   WARNING: Cannot serialize session attribute SPRING_SECURITY_CONTEXT for session    DDB4A51B19CF042B227E312B546483EF
java.io.NotSerializableException: java.util.HashMap$KeySet
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1180)
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1528)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1493)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1416)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1174)
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1528)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1493)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1416)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1174)
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1528)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1493)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1416)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1174)
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1528)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1493)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1416)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1174)
at java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java:346)
at org.apache.catalina.session.StandardSession.writeObject(StandardSession.java:1561)
at org.apache.catalina.session.StandardSession.writeObjectData(StandardSession.java:1004)
at com.radiadesign.catalina.session.JavaSerializer.serializeFrom(JavaSerializer.java:24)
at com.radiadesign.catalina.session.RedisSessionManager.save(RedisSessionManager.java:411)
at com.radiadesign.catalina.session.RedisSessionHandlerValve.storeOrRemoveSession(RedisSessionHandlerValve.java:39)
at com.radiadesign.catalina.session.RedisSessionHandlerValve.invoke(RedisSessionHandlerValve.java:27)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:554)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
at java.lang.Thread.run(Thread.java:636)

Please provide further information: are you using "stock" SecurityContext, Authentication, UserDetails instances, or is it a customized Spring Security configuration? — gpeche
– gpeche, Commented Sep 17, 2014 at 7:40
Default SecurityContext , UsernamePasswordAuthenticationToken and CustomUserDetails extends org.springframework.security.core.userdetails.User implements Serializable — nglasantha
– nglasantha, Commented Sep 17, 2014 at 8:37
Can you post your CustomUserDetails? Maybe it contains some non-serializable attribute — gpeche
– gpeche, Commented Sep 17, 2014 at 8:46
Hi gpeche, Yes you are correct. There was a non-serializable attribute. Thanks for given help and support. — nglasantha
– nglasantha, Commented Sep 17, 2014 at 9:47

naXa stands with Ukraine · Accepted Answer · 2017-02-09 14:10:31Z

6

There was a non-serializable attribute in CustomUserDetails class.

edited Feb 9, 2017 at 14:10

naXa stands with Ukraine

38.6k25 gold badges208 silver badges279 bronze badges

answered Sep 17, 2014 at 9:49

nglasantha

1131 gold badge1 silver badge6 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

nglasantha Over a year ago

It was : private Set<String> set1 = someDataMap.keySet(); and changed to : private Set<String> set1 = new HashSet<String>(someDataMap.keySet());

TheRealChx101 Over a year ago

How did you solve this? Implementing ```Serializable``? Your answer doesn't add anything

Collectives™ on Stack Overflow

Cannot serialize session attribute SPRING_SECURITY_CONTEXT for session

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related