server.servlet.session.cookie.http-only=true
server.servlet.session.cookie.secure=true
server.servlet.session.cookie.max-age=-1
server.servlet.session.cookie.name=SESSION
server.servlet.session.timeout=14400s
#server.session.timeout=14400s # tried to uncomment this, just to be sure, but nothing changed
spring.session.store-type=redis
spring.data.redis.repositories.enabled = false
spring.redis.host=redis
spring.redis.port=6379
The app completely ignores these properties and all redis sessions are created with TTL around 1800 seconds.
I don't use EnableRedisHttpSession or EnableJdbcHttpSession or anything session related.
Only thing I use are these:
@SpringBootApplication(scanBasePackages = ["app"])
@EnableHypermediaSupport(type = [EnableHypermediaSupport.HypermediaType.HAL])
@EnableScheduling
@EnableWebSecurity
class BackendApplication
@Configuration
class SecurityConfig : WebSecurityConfigurerAdapter() {
    public override fun configure(http: HttpSecurity) {
        http.csrf().disable()
            .cors()
            .and()
            .exceptionHandling()
            .authenticationEntryPoint(restAuthenticationEntryPoint)
            .and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED).and() //                .httpBasic().realmName("AD").and()
            .httpBasic().disable() // we use our own implementation for HttpBasic
            .formLogin().loginProcessingUrl("/login").and()
            .logout().logoutUrl("/logout").logoutSuccessHandler(HttpStatusReturningLogoutSuccessHandler(HttpStatus.NO_CONTENT)).permitAll().and()
            .addFilter(CustomBasicAuthenticationFilter(authenticationManager(), userService))
            .addFilterAt(RestAuthenticationFilter(authenticationManager(), userService), UsernamePasswordAuthenticationFilter::class.java)
            .authorizeRequests()
            .antMatchers("/login").permitAll()
            .antMatchers("/actuator/info").permitAll()
            .antMatchers("/actuator/health").permitAll()
            .antMatchers("/actuator/**").hasRole("ADMIN")
            .anyRequest().authenticated()
Only if I add @EnableRedisHttpSession(maxInactiveIntervalInSeconds = 14400), then and only then the records in redis have correct TTL.
I couldn't find anything relevant in --debug output (but I don't know what I should be looking for).
What could be the problem in my case? Could it be the WebSecurityConfigurerAdapter stuff?

EDIT: I've tried removing all @EnableXYZ annotations from the code, but no change, TTL is still around 1800s.
          
@daliborfilus Can you please open a new issue with a small sample that reproduces the problem? In the absence of spring.session.timeout being set, server.servlet.session.timeout should be used to auto-configure Spring Session's session timeout. Your WebSecurityConfigurerAdapter shouldn't have any effect on that.
          
So I was creating the example app with smallest possible reproducible case and I've nailed the problem down to this line in my build.gradle config:
    configurations {
        compile.exclude group: 'jakarta.annotation', module: 'jakarta.annotation-api' // <<- THIS ONE
If I remove it (or comment it out), the server.servlet.session.timeout=14400s line in application.properties works.(Tested using redis-cli monitor multiple times).
I remember excluding this group when I played with java jigsaw modules and it something was complaining about the same interfaces being implemented in more than one package or something like that.
Should I still create a new issue? I still don't understand why excluding jakarta.annotation group would result in such weird behavior. The application works with this for over a year and the only thing that doesn't work correctly is this redis session timeout thing...
      server.servlet.session.timeout not in effect when using Jetty starter without jakarta.annotation and javax.annotation
      #23716