RFC-0006: Implement Redis Session Management #6
Description
📋 RFC Reference
Document: RFC-0006: Redis Session Management
Version: 0.2.0
Phase: Phase 2 - Security Features
Depends On: #1 (RFC-0001), #3 (RFC-0003)
🎯 Objective
Implement Redis-based session cache with connection pooling, nonce validation, rate limiting, and optimized memory usage for fast session lookups and correlation.
📦 Acceptance Criteria
Redis Connection
- deadpool-redis connection pool configured
- Pool size calculated using formula (20 connections for 10k req/sec)
- Connection timeout: 5 seconds
- Idle timeout: 60 seconds
- Health check on borrow
Session Storage
-
session:{id}hash structure implemented - Session metadata stored (fingerprint, IP hash, timestamps)
- 1-hour TTL on session keys
- Atomic operations for updates
- Pipelining for batch operations
Nonce Management
-
nonce:{value}key storage - 5-minute TTL on nonces
- Input validation (alphanumeric + hyphen only)
- Length validation (max 100 chars)
- Uniqueness check via EXISTS
- Replay attack prevention
Fingerprint Correlation
-
fingerprint:{hash}set structure - Multiple sessions per fingerprint
- Fast lookup by fingerprint
- Set cardinality monitoring
- Automatic cleanup on session expiry
Rate Limiting
- Per-IP rate limiting (100 req/min)
- Per-session rate limiting (configurable)
- Sliding window implementation
- INCR + EXPIRE atomic operations
- Rate limit headers in response
Input Validation
- Fingerprint hash validation (64 hex chars)
- Nonce format validation
- Session ID validation (UUID format)
- Length limits enforced
- Prevent Redis command injection
Error Handling
- Connection failure handling
- Timeout handling
- Retry logic (3 attempts with exponential backoff)
- Circuit breaker for Redis failures
- Graceful degradation (skip cache on failure)
Performance
- GET latency < 1ms (p99)
- SET latency < 1ms (p99)
- HGETALL latency < 3ms (p99)
- Pipeline operations < 5ms (p99)
- Memory per session < 1KB
Memory Optimization
- 1-hour session retention (not 24h)
- Memory usage: 36GB for 10k req/sec
- Redis instance: 2× cache.r6g.2xlarge (128GB total)
- Eviction policy: allkeys-lru
- Memory monitoring and alerts
Testing
- Unit tests for all operations (>90% coverage)
- Integration tests with real Redis
- Nonce validation tests
- Rate limiting tests
- Connection pool tests
- Failover tests
Documentation
- Redis schema documentation
- Connection pool sizing guide
- Rate limiting configuration
- Memory optimization guide
- Monitoring setup
📚 Key Files to Create
crates/scrybe-cache/
├── Cargo.toml
├── src/
│ ├── lib.rs # Public API
│ ├── client.rs # Redis client + pool
│ ├── session.rs # Session operations
│ ├── nonce.rs # Nonce validation
│ ├── rate_limit.rs # Rate limiting
│ ├── validation.rs # Input validation
│ └── types.rs # CachedSession, etc.
└── tests/
└── integration_test.rs
deployment/redis/
├── redis.conf # Redis configuration
└── scripts/
└── memory-check.sh
🔗 Dependencies
Depends On:
- RFC-0001: Implement Core Architecture #1 (RFC-0001: Core Architecture)
- RFC-0003: Implement Rust Ingestion Gateway #3 (RFC-0003: Ingestion Gateway - needs nonce validation)
Blocks:
- None (can work in parallel)
🧪 Testing Checklist
- All unit tests pass
- Integration tests pass
- Nonce prevents replay attacks
- Rate limiting enforced
- Connection pool sized correctly
- Memory usage within limits
- Test coverage > 90%
📊 Success Metrics
- GET latency < 1ms (p99)
- SET latency < 1ms (p99)
- Nonce validation success rate 100%
- Rate limiting accuracy > 99%
- Memory usage: 36GB (1h retention)
- Connection pool efficiency > 95%
💰 Cost Optimization
Before: 24h retention = 864GB = $4,800/month
After: 1h retention = 36GB = $1,200/month
Savings: 75% reduction
🔒 Security Checklist
- Input validation prevents injection
- Nonce validation prevents replay
- Rate limiting prevents abuse
- No sensitive data in keys
- TLS enabled for connections
🦉 TigerStyle Compliance
- No unwrap/expect/panic
- All errors via Result
- Explicit error handling
- Public APIs documented
- Test coverage > 90%
Estimated Effort: 1.5 weeks
Assigned To: TBD
Related RFCs: RFC-0006 v0.2.0