[ http://jira.jboss.com/jira/browse/JBAS-1580?page=history ]
Clebert Suconic reopened JBAS-1580:
-----------------------------------
Remy,
I think you have answered Clebert's question saying that when a session is
invalidated, we are supposed to re-use the session id to create a new session
object, right?
In this case, I still have a bug in my replication code that doesn't handle
this correctly all the time then.
Thanks,
-Ben
-----Original Message-----
From: Remy Maucherat
Sent: Tuesday, March 29, 2005 3:49 PM
To: Clebert Suconic
Cc: Ben Wang; Scott M Stark; Ryan Campbell
Subject: RE: Session Invalidation
> Remy,
>
> Can solve a question for me and Ben please...
>
> We have a TestCase that behaves like this:
>
> Int i=0;
>
> HttpClient client = new HttpClient(); /// this HttpClient can hold
> cookies without any problem, like the way a browser does.
> Invfinite Loop {
> I++
>
> If (i<3)
> {
> Client.invoke(WhateverURL);
> } else
> {
> I=0;
> Client.invoke(An URL that Will Invalidate the Session);
> }
> }
>
>
>
> This client will call a Servlet that will have an invalidation on
> every 3 callings.
>
>
> The clustered session is failing, throwing some exceptions as the
> HttpClient is using the same session cookie even after its invalidation.
> You will see more descriptions about this error on this JIRA-Task:
> http://jira.jboss.com/jira/browse/JBCACHE-102
>
> If we recreate the Client at the third iteration, we don't have an
> error any more.
>
> So... a question:
>
> How do you implement Session Invalidation at Tomcat. Do you reassign
> the session cookie by removing the cookie, or do you keep the cookie?
>
>
> My point is, isn't the server's responsibility to delete the session
> cookie or assign a new one when the server invalidates the Session.
>
> Just pretend a client that pressed log-off but will keep using another
> account login. The HttpClient would be the same and unless the server
> resend/delete the cookies the Session would be the same.
>
> If this is true, we will have to reopen
> http://jira.jboss.com/jira/browse/JBCACHE-102, even if we have to
> defer it to the next version, as in 90% of the cases the client closes
> the browser after its invalidation.
> By creating a new HttpClient you are assuming that the client is
> closing the browser and a new client is arriving in.
>
>
>
> Clebert
>
>
>
> PS: I started this thread as an e-mail just to make it easier, but
> this will be copied into http://jira.jboss.com/jira/browse/JBCACHE-102
> and http://jira.jboss.com/jira/browse/JBAS-1580 eventually.
As far as I can understand, you are confusing session object, session cookie,
and session id. Any cookie will not be removed (of course). With the current
default setup, session ids from submitted cookies will actually also be reused.
The only thing for which state matters is the session object, and so your case
is not supposed to fail.
RÃmy
> Problem when Submitting Massive Load into HttpSession
> -----------------------------------------------------
>
> Key: JBAS-1580
> URL: http://jira.jboss.com/jira/browse/JBAS-1580
> Project: JBoss Application Server
> Type: Bug
> Components: JBoss Cache service
> Versions: JBossAS-3.2.7 Final, JBossAS-3.2.6 Final, JBossAS-5.0 Alpha,
> JBossAS-3.2.5 Final, JBossAS-4.0.2RC1, JBossAS-4.0.1 SP1
> Reporter: Clebert Suconic
> Assignee: Ben Wang
> Fix For: JBossAS-5.0 Alpha, JBossAS-4.0.2 Final, JBossAS-3.2.8 Final
>
>
> Description available at:
> http://jira.jboss.com/jira/browse/JBCACHE-102
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_ide95&alloc_id396&op=click
_______________________________________________
JBoss-Development mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/jboss-development
