Share Spring Session with Redis Database

Following scenario:

DESCRIPTION:

I develop two microservices with Spring. One Service is the auth service and generates the session. The other service is the ui-service which needs to know if a requesting client is authorized. After some reading I found out that sharing the session with redis seems to be a good solution. (Correct me if there is a better way ) For the coding I followed the example here

Status quo: My auth service works and generates a session in redis:

For example:

127.0.0.1:6379> keys *
1) "spring:session:sessions:a4c11990-94a4-4b99-bc77-33f2084e5e8f"
2) "spring:session:sessions:expires:a4c11990-94a4-4b99-bc77-33f2084e5e8f"
3) "spring:session:sessions:26f24541-74dd-4410-84ac-d051a64d1263"
4) "spring:session:index:org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME:userA"
5) "spring:session:expirations:1557314160000"
6) "spring:session:sessions:expires:26f24541-74dd-4410-84ac-d051a64d1263"

Now I want to call a test endpoint of my ui service. This call should be successfull if the session is valid and access denied when there is no valid session. Atm I always get an access denied error in my ui service.

Code: My auth service:

application.properties

spring.session.store-type=redis
spring.session.redis.flush-mode=on-save
spring.session.redis.namespace=spring:session
spring.redis.host=localhost
spring.redis.port=6379

pom.xml

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-redis</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.session</groupId>
            <artifactId>spring-session-data-redis</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.session</groupId>
            <artifactId>spring-session</artifactId>
            <version>1.3.5.RELEASE</version>
        </dependency>

SessionConfig

@Configuration
@EnableRedisHttpSession
public class SessionConfig extends AbstractHttpSessionApplicationInitializer {
      @Bean
        public JedisConnectionFactory jedisConnectionFactory() {
            return new JedisConnectionFactory();
        }
@Bean
public HttpSessionIdResolver httpSessionIdResolver() {
    CookieHttpSessionIdResolver resolver = new CookieHttpSessionIdResolver();
    DefaultCookieSerializer cookieSerializer = new DefaultCookieSerializer();
    cookieSerializer.setUseBase64Encoding(false);
    resolver.setCookieSerializer(cookieSerializer);
    return resolver; 
}

and in my main class I did

@EnableRedisHttpSession

And in my UI Service:

pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.1.4.RELEASE</version>
        <relativePath /> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.test</groupId>
    <artifactId>Redistest</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>Redistest</name>
    <description>Microservice for Data Management</description>

    <properties>
        <java.version>1.8</java.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>


                <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-redis</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.session</groupId>
            <artifactId>spring-session-data-redis</artifactId>
        </dependency>

            <dependency>
            <groupId>org.springframework.session</groupId>
            <artifactId>spring-session</artifactId>
            <version>1.3.5.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>redis.clients</groupId>
            <artifactId>jedis</artifactId>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>

main:

@EnableWebSecurity
@SpringBootApplication
public class RedistestApplication {

    public static void main(String[] args) {
        SpringApplication.run(RedistestApplication.class, args);
    }

SessionConfig:

@Configuration
@EnableRedisHttpSession
public class SessionConfig extends AbstractHttpSessionApplicationInitializer {
      @Bean
        public JedisConnectionFactory jedisConnectionFactory() {
            return new JedisConnectionFactory();
            }
 @Bean
    public HttpSessionIdResolver httpSessionIdResolver() {
        return HeaderHttpSessionIdResolver.xAuthToken(); 
    }

WebSecurity:

@Configuration
public class WebSecurity extends WebSecurityConfigurerAdapter{

     @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .anyRequest().authenticated();
        }
}

}

Controller

@RestController
public class TestController {

    @GetMapping("/name")
    public String getName() {
        return "Hallo From Test";
    }

}

QUESTION: I'm not getting any error in my services. It seems like I just can't use the session from reddis. In the tutorial the author says that there might be a problem with the base64 encoding of the session-id in the cookie. I guess this might be the problem. Do you have any suggestion or see any error in my implementation? Do I have to disable the HttpSession exlipcitly? Thank's for your help/hints.

EDIT: I just recognized that in my browser Inspect (Firefox) i'm not having any "x-auth" field. My intention is to save the auth id (Session-id) in the header not as a cookie. So I expect that my auth service should set the sessionid as x-auth field in the header. Is that correct? So the error seems to come from the auth service?