[jira] [Created] (PLUTO-727) PortletSession invalidated in the HEADER_PHASE gets recycled and reused in the RENDER_PHASE

Neil Griffin created PLUTO-727:
----------------------------------

             Summary: PortletSession invalidated in the HEADER_PHASE gets recycled and reused in the RENDER_PHASE
                 Key: PLUTO-727
                 URL: https://issues.apache.org/jira/browse/PLUTO-727
             Project: Pluto
          Issue Type: Bug
          Components: portlet container
    Affects Versions: 3.0.1, 3.0.0
            Reporter: Neil Griffin
            Assignee: Neil Griffin
             Fix For: 3.0.2


As shown in the following example, session attributes set in the {{HEADER_PHASE}} should not be available in the subsequent {{RENDER_PHASE}} if the {{PortletSession}} is invalidated in the {{HEADER_PHASE}}:

{code:java|title=MyPortlet.java}
public class MyPortlet extends GenericPortlet {

    @Override
    public void renderHeaders(HeaderRequest headerRequest, HeaderResponse headerResponse) {
        PortletSesson portletSession = headerRequest.getPortletSession();
        portletSession.setAttribute("foo", "1234");
        portletSession.invalidate();
    }

    @Override
    public void doView(RenderRequest renderRequest, RenderResponse renderResponse) {
        PortletSesson portletSession = headerRequest.getPortletSession();
        String foo = (String) portletSession.getAttribute("foo");
        if (foo == null) {
            // Correct
        }
        else {
            // Incorrect
        }
    }
}
{code}

However, due to a cross-context issue incompatibility between Apache Pluto and Apache Tomcat, the PortletSession invalidated in the {{HEADER_PHASE}} gets recycled and reused in the {{RENDER_PHASE}}.

The problem stems from a [special cross-context case found in Tomcat's ApplicationHttpRequest.java class|https://github.com/apache/tomcat/blob/TOMCAT_8_0_0/java/org/apache/catalina/core/ApplicationHttpRequest.java#L541-L542] that recycles {{HttpSession}} objects even if they were previously invalidated.

The workaround is to keep track of invalidated {{HttpSession}} identifiers in Apache Pluto and to clear the session attributes if Tomcat produces an invalidated/recycled {{HttpSession}.

A similar problem of was reported in PLUTO-436 which required caused the developer to add [comments in PortletRequestContextImpl.java|https://github.com/apache/portals-pluto/blob/pluto-3.0.1/pluto-portal-driver-impl/src/main/java/org/apache/pluto/driver/services/container/PortletRequestContextImpl.java#L370-L377] that describe the workaround.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)