Oturum Yönetimi ve Stateless Ölçekleme

1
spring:
2
  data:
3
    redis:
4
      host: redis
5
      port: 6379
6
  session:
7
    timeout: 5m                   # short idle timeout: an unattended screen logs out quickly
8
    redis:
9
      namespace: ebank:session     # keys: ebank:session:sessions:<id>
10
      flush-mode: on-save          # write once per request, not on every setAttribute
11
# Cookie settings live in SessionCookieConfig: with a custom CookieSerializer,
12
# server.servlet.session.cookie.* is not used by Spring Session.

1
@Configuration
2
class SessionCookieConfig {
3

4
    @Bean
5
    CookieSerializer cookieSerializer() {
6
        var cookie = new DefaultCookieSerializer();
7
        cookie.setCookieName("EBANKSESSION");
8
        cookie.setUseHttpOnlyCookie(true);   // not readable from JavaScript
9
        cookie.setUseSecureCookie(true);     // HTTPS only
10
        cookie.setSameSite("Strict");        // never sent from another site, not even on links
11
        return cookie;
12
    }
13
}

1
// Stored in Redis between "enter details" and "confirm with SMS code".
2
// Only what the confirm step needs; the balance is read fresh, never cached here.
3
public record TransferDraft(
4
        UUID draftId,
5
        String fromIban,
6
        String toIban,
7
        String receiverName,
8
        BigDecimal amount,
9
        Instant createdAt) implements Serializable {
10

11
    @Serial
12
    private static final long serialVersionUID = 1L;
13

14
    public boolean expired(Clock clock, Duration ttl) {
15
        return createdAt.plus(ttl).isBefore(Instant.now(clock));
16
    }
17
}

1
@RestController
2
@RequestMapping("/transfers")
3
class TransferWizardController {
4

5
    private static final String DRAFT = "transferDraft";
6

7
    private final TransferService transfers;
8
    private final OtpService otp;
9
    private final Clock clock;
10

11
    TransferWizardController(TransferService transfers, OtpService otp, Clock clock) {
12
        this.transfers = transfers;
13
        this.otp = otp;
14
        this.clock = clock;
15
    }
16

17
    // Step 1 (may land on pod A): validate, keep a draft, send an SMS code.
18
    @PostMapping("/draft")
19
    ResponseEntity<Void> draft(@RequestBody @Valid NewTransfer body, HttpSession session,
20
                               @AuthenticationPrincipal Customer customer) {
21
        var draft = new TransferDraft(UUID.randomUUID(), body.fromIban(), body.toIban(),
22
                body.receiverName(), body.amount(), Instant.now(clock));
23
        session.setAttribute(DRAFT, draft);
24
        otp.send(customer.phone(), draft.draftId());
25
        return ResponseEntity.accepted().build();
26
    }
27

28
    // Step 2 (may land on pod B): the draft is still there because it lives in Redis.
29
    @PostMapping("/confirm")
30
    ResponseEntity<TransferReceipt> confirm(@RequestBody @Valid OtpCode code, HttpSession session) {
31
        TransferDraft draft = (TransferDraft) session.getAttribute(DRAFT);
32
        if (draft == null || draft.expired(clock, Duration.ofMinutes(3))) {
33
            return ResponseEntity.status(HttpStatus.GONE).build();
34
        }
35
        otp.verify(draft.draftId(), code.value());
36
        session.removeAttribute(DRAFT);          // a draft is confirmed once, never twice
37
        return ResponseEntity.ok(transfers.execute(draft));
38
    }
39
}

1
@RestController
2
@RequestMapping("/loan-applications/{id}/documents")
3
class LoanDocumentController {
4

5
    private final ObjectStorage storage;    // S3, GCS or MinIO behind one interface
6

7
    LoanDocumentController(ObjectStorage storage) {
8
        this.storage = storage;
9
    }
10

11
    @PostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
12
    ResponseEntity<Void> upload(@PathVariable long id, @RequestPart MultipartFile incomeProof) throws IOException {
13
        // NOT incomeProof.transferTo(Path.of("/tmp/uploads/...")): the credit analyst's
14
        // request may land on another pod, and this pod's disk disappears with the pod.
15
        String key = "loan-applications/" + id + "/" + UUID.randomUUID() + ".pdf";
16
        storage.put(key, incomeProof.getInputStream(), incomeProof.getSize(), "application/pdf");
17
        return ResponseEntity.created(URI.create("/documents/" + key)).build();
18
    }
19
}

1
apiVersion: v1
2
kind: Service
3
metadata:
4
  name: ebank
5
spec:
6
  selector:
7
    app: ebank
8
  ports:
9
    - port: 80
10
      targetPort: 8080
11
  # No sessionAffinity: ClientIP. Any pod can serve any request, so scaling,
12
  # deploys and a dying pod do not log a customer out halfway through a transfer.