Since the lifetime of session objects span requests and since session objects are expired asynchronously by the background thread created by the session manager, if one did recycle session objects then isn't it possible for 2 separate requests to access and possibly modify a session object simultaneously ?
- Request 1 gets access to a session (session-timeout = 1 minute) - Request 1 then does some operations that take a couple of minutes - The session manager thread expires the session and recycles the session object - Request 2 asks for a session and gets a reference to the recycled session object and starts using it - Request 1's database operations complete and it too uses the session o.a.c.session.ManagerBase has an ArrayList 'recycled' that is used for recycling session objects. 4.0.x never uses this because manager is set to null in StandardSession.recycle() and hence ManagerBase.recycle() is never invoked. 4.1 however, does recycle sessions and does run into the problem described in the above scenario when running a session based load on a multi-cpu box. If this is indeed a problem, I can submit a patch that removes the session recycling code. Thanks, Arvind -- To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]> For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>