REF-8: Fix seconds/milliseconds mixup in in-memory session cleanup (issue #76)

[thomasnymand]

Fixes #76

Summary

On the in-memory session handler, sessions expired ~1000x too early — a 30-minute timeout became 1.8 seconds — logging users out on almost every cleanup run. The database session handler was not affected.

Root cause: SessionHandler.cleanup(long maxInactiveIntervalSeconds) takes the timeout in seconds (as the DatabaseSessionHandler and the caller, which reads HttpSession.getMaxInactiveInterval(), both treat it). But InMemorySessionHandler.cleanup() passed that seconds value straight to TimeOutWrapper.isExpired(delay), which compares against System.currentTimeMillis() and therefore expects milliseconds.

Fix

• InMemorySessionHandler.cleanup() — convert seconds → milliseconds before the expiry comparison.
• SessionCleanerTask — fix the debug log that printed the timeout inconsistently (* 1000).
• Correct the misleading "Milliseconds" javadoc on the cleanup contract (SessionHandler) and both implementations — the parameter is seconds.

Test

Adds an InMemorySessionHandlerTest regression test that stores an assertion, waits well past the buggy milliseconds interpretation but far short of the real seconds timeout, and asserts the assertion is still present. Full suite: Tests run: 108, Failures: 0, Errors: 0.

Attribution

Ports the fix from the Trifork fork (Jeppe Sommer, commits 6485c2b and bc7b004), and adds the regression test those commits lacked.

🤖 Generated with Claude Code

[mthiim]

I have added one comment

[mthiim]

My only concern is if someone previously called this method and is relying on the old behavior (maybe they found the error and compensated by passing in milliseconds, meaning now they will overshoot by 1000x). Probably not a big issue - either the current method could be kept as is and a new cleanup addded, but maybe better to just document it clearly when releasing?

[thomasnymand]

You are perfectly right :) I suggest handling by adding clear and obvious documentation in release note.