Auto-configuration's session repository customization may override that of SessionRepositoryCustomizer beans

[ashitikov-bld]

Hi,
It seems there's missed @Order(Ordered.HIGHEST_PRECEDENCE) on springBootSessionRepositoryCustomizer in RedisSessionConfiguration.IndexedRedisSessionConfiguration. The default customizer is always applied after my custom one and I cannot control this over @Order annotation on my bean.
Spring Boot 3.1.2.

[wilkinsona]

I think we could order it at 0 but that would be a potentially breaking change so it couldn't be done in a maintenance release.

Given that springBootSessionRepositoryCustomizer only applies values from configuration properties, I'm curious to know why you're also trying to configure those values using a SessionRepositoryCustomizer. Why not use configuration properties instead?

[ashitikov-bld]

I've already rewritten to configuration properties.
Hovewer there can be a case when you need to set namespace or smth depending on some condition.

[wilkinsona]

I've just noticed that Boot's SessionRepositoryCustomizer<JdbcIndexedSessionRepository> is @Order(Ordered.HIGHEST_PRECEDENCE). This came from #33514 which fixed a regression, restoring in 3.0.x the behaviour that we had in 2.7.x. It looks like that same regression applies to the other session stores as well as they all moved from the customizer approach at the same time in #32554.

In light of the above, I've changed my mind. I think we should fix this in 3.0.x and later. The order should be Ordered.HIGHEST_PRECEDENCE as this aligns things most closely with how they worked in 2.7..

[quaff]

We should review Customizer in other *Configuration not only SessionConfiguration, discuss whether Ordered.HIGHEST_PRECEDENCE or 0 is more appropriate.