Session API doesn't clarify behavior for maxInactiveInterval of 0

See the following snippets from our Session API:

https://github.com/spring-projects/spring-session/blob/5d0775b802514da469e43fa00d9cdd58f238b30e/spring-session-core/src/main/java/org/springframework/session/Session.java#L135-L142

https://github.com/spring-projects/spring-session/blob/5d0775b802514da469e43fa00d9cdd58f238b30e/spring-session-core/src/main/java/org/springframework/session/Session.java#L144-L151

So the API defines negative value as never timeout and says nothing on 0 value. In practice, I believe we treat 0 as expire now but need to verify this for all SessionRepository implementations.

OTOH the Servlet API's HttpSession says the following:

/**
 * Specifies the time, in seconds, between client requests before the 
 * servlet container will invalidate this session. 
 *
 * <p>An <tt>interval</tt> value of zero or less indicates that the
 * session should never timeout.
 *
 * @param interval      An integer specifying the number
 *              of seconds 
 */    
public void setMaxInactiveInterval(int interval);

/**
 * Returns the maximum time interval, in seconds, that 
 * the servlet container will keep this session open between 
 * client accesses. After this interval, the servlet container
 * will invalidate the session.  The maximum time interval can be set
 * with the <code>setMaxInactiveInterval</code> method.
 *
 * <p>A return value of zero or less indicates that the
 * session will never timeout.
 *
 * @return      an integer specifying the number of
 *          seconds this session remains open
 *          between client requests
 *
 * @see     #setMaxInactiveInterval
 */
public int getMaxInactiveInterval();

With that in mind, the issue is that HttpSessionAdapter effectively doesn't respect the Servlet API by doing this:

https://github.com/spring-projects/spring-session/blob/5d0775b802514da469e43fa00d9cdd58f238b30e/spring-session-core/src/main/java/org/springframework/session/web/http/HttpSessionAdapter.java#L98-L106

Another API to consider here is WebSession, which also doesn't clarify behavior for 0 value.

/cc @rwinch

spring-projects / spring-session

Session API doesn't clarify behavior for maxInactiveInterval of 0 #1192