Due to some of the issues brought to light by BEEHIVE-1028, I would like to
propose that we remove the ability to store a session bean context in the
HttpSession when using the ControlFilter.
Here's a summary of the issue:
When multiple threads within the same session hit a ControlFilter (with the
ControlFilter's 'useSession' init param set to true). The same
ServletBeanContext may be used for both threads:
ThreadId Info
------------- ------------------------------------------
34 onAcquire
34 begin dummyControlMethod
34 end dummyControlMethod
35 begin dummyControlMethod
34 onRelease
35 end dummyControlMethod
Here is what happens in the ServletBeanContext:
- A new ServletBeanContext is created and stored in the session for thread
#34
- The ServletBeanContext's beginContext() method is invoked and passed the
current request and response for thread #34
- Thread #35 sees that there is already a context in the session, grabs it
and calls begin context with its request and response.
- The ServletBeanContext's beginContext() method stores requests and
responses on a Stack.
- Now thread #34 calls ServletBeanContext().endContext() which pops the
Stack (pops thread #35's request and response from the stack
- Now we are at a point in which things are pretty messed up.
I believe that the core issue here is that it is improper to store a bean
context in a session, since the servlet bean context works on a per-request
scope, but at any given time there may be multiple requests made on a single
session.
My recommendation would be to remove the ability to store the bean context
in the session, and just create a new bean context for each request
received. This is a fairly straightforward modification to the ControlFilter
and will resolve this issue.
Questions/Comments?
- Thanks,
Chad
