ClassCastException calling SpringSessionWebSessionStore.updateLastAccessTime(WebSession) with Spring Security 6.2 and OAuth2 login enabled about spring-session HOT 2 CLOSED

Hi @marcusdacoregio, thank you for looking into this issue.

What is the reason that you are updating the last access time for the web session manually?

The reason is that the session is only touched conditionally i.e. some requests must not prolong the session lifetime. My given example above did not showed that as I simplified the code.

Have you tried to place your filter before the OidcSessionRegistryWebFilter?

Thank you for that hint, didn't thought about this yet. OidcSessionRegistryWebFilter is part of the SecurityWebFilterChain which has the default order of -100 (c.f. here. So annotating my web filter with @Ordered(-101) worked.

I'm fine with that and from my end the ticket can be closed.

from spring-session.

Hi, @MatthiasZerau. Thanks for the report.

What is the reason that you are updating the last access time for the web session manually? I wonder why you didn't let the WebSessionManager deal with that.

Have you tried to place your filter before the OidcSessionRegistryWebFilter? Something like http.addFilterBefore(myFilter, SecurityWebFiltersOrder.HTTP_HEADERS_WRITER);. Note that your WebFilter is annotated with @Component, therefore Spring Boot will register it automatically in the filter chain, I do not recall correctly the ordering that it will apply.

from spring-session.