JDBC session with negative timeout should never expire

Closes gh-1847

Author: eleftherias

spring-session-jdbc/src/integration-test/java/org/springframework/session/jdbc/AbstractJdbcIndexedSessionRepositoryITests.java

@@ -586,6 +586,18 @@ void cleanupInactiveSessionsUsingSessionDefinedInterval() {
 		assertThat(this.repository.findById(session.getId())).isNull();
 	}
 
+	@Test
+	void cleanupExpiredSessionsWhenMaxInactiveIntervalNegativeThenSessionNotDeleted() {
+		JdbcSession session = this.repository.createSession();
+		session.setMaxInactiveInterval(Duration.ofSeconds(-1));
+		session.setLastAccessedTime(Instant.now().minusSeconds(MapSession.DEFAULT_MAX_INACTIVE_INTERVAL_SECONDS + 1));
+
+		this.repository.save(session);
+		this.repository.cleanUpExpiredSessions();
+
+		assertThat(this.repository.findById(session.getId())).isNotNull();
+	}
+
 	@Test
 	void changeSessionIdWhenOnlyChangeId() {
 		String attrName = "changeSessionId";

spring-session-jdbc/src/main/java/org/springframework/session/jdbc/JdbcIndexedSessionRepository.java

@@ -185,7 +185,8 @@ public class JdbcIndexedSessionRepository
 	// @formatter:off
 	private static final String DELETE_SESSION_QUERY = ""
 			+ "DELETE FROM %TABLE_NAME% "
-			+ "WHERE SESSION_ID = ?";
+			+ "WHERE SESSION_ID = ? "
+			+ "AND MAX_INACTIVE_INTERVAL >= 0";
 	// @formatter:on
 
 	// @formatter:off
@@ -701,6 +702,9 @@ void clearChangeFlags() {
 		}
 
 		Instant getExpiryTime() {
+			if (getMaxInactiveInterval().isNegative()) {
+				return Instant.ofEpochMilli(Long.MAX_VALUE);
+			}
 			return getLastAccessedTime().plus(getMaxInactiveInterval());
 		}