(tomcat) branch 10.1.x updated: Prevent session swap out if associated with currently active request

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/10.1.x by this push:
     new 05d0f422b9 Prevent session swap out if associated with currently active request
05d0f422b9 is described below

commit 05d0f422b9ea5dc8ba858629902310d74d5da197
Author: Mark Thomas <[email protected]>
AuthorDate: Mon Aug 24 08:58:59 2026 +0100

    Prevent session swap out if associated with currently active request
---
 .../apache/catalina/session/PersistentManagerBase.java    | 15 ++++++++++-----
 webapps/docs/changelog.xml                                |  7 +++++++
 webapps/docs/config/manager.xml                           | 14 ++++++++++++++
 3 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/java/org/apache/catalina/session/PersistentManagerBase.java b/java/org/apache/catalina/session/PersistentManagerBase.java
index 286f0e7b63..6fe6f44044 100644
--- a/java/org/apache/catalina/session/PersistentManagerBase.java
+++ b/java/org/apache/catalina/session/PersistentManagerBase.java
@@ -360,9 +360,14 @@ public abstract class PersistentManagerBase extends ManagerBase implements Store
     }
 
 
-    // --------------------------------------------------------- Public Methods
+    @Override
+    public boolean getSessionActivityCheck() {
+        return super.getSessionActivityCheck() || minIdleSwap > -1 || maxIdleSwap > -1;
+    }
 
 
+    // --------------------------------------------------------- Public Methods
+
     /**
      * Clear all sessions from the Store.
      */
@@ -914,8 +919,8 @@ public abstract class PersistentManagerBase extends ManagerBase implements Store
                 }
                 int timeIdle = (int) (session.getIdleTimeInternal() / 1000L);
                 if (timeIdle >= maxIdleSwap && timeIdle >= minIdleSwap) {
-                    if (session.accessCount != null && session.accessCount.get() > 0) {
-                        // Session is currently being accessed - skip it
+                    if (session.accessCount == null || session.accessCount.get() > 0) {
+                        // Session access is not tracked or session is currently being accessed - skip it
                         continue;
                     }
                     if (log.isTraceEnabled()) {
@@ -962,8 +967,8 @@ public abstract class PersistentManagerBase extends ManagerBase implements Store
             synchronized (session) {
                 int timeIdle = (int) (session.getIdleTimeInternal() / 1000L);
                 if (timeIdle >= minIdleSwap) {
-                    if (session.accessCount != null && session.accessCount.get() > 0) {
-                        // Session is currently being accessed - skip it
+                    if (session.accessCount == null || session.accessCount.get() > 0) {
+                        // Session access is not tracked or session is currently being accessed - skip it
                         continue;
                     }
                     if (log.isTraceEnabled()) {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 7a98704fa3..571755d295 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -136,6 +136,13 @@
         default method implementation provided only provides the pre-fix
         functionality. (markt)
       </fix>
+      <fix>
+        Ensure that <code>PersistentManager</code> implementations that extend
+        <code>PersistentManagerBase</code> do not swap out sessions that are
+        associated with a request that is currently being processed. This
+        includes not swapping out a session unless the session was created when
+        activity tracking was enabled. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Cluster">
diff --git a/webapps/docs/config/manager.xml b/webapps/docs/config/manager.xml
index 28f70afdff..39f8f8549d 100644
--- a/webapps/docs/config/manager.xml
+++ b/webapps/docs/config/manager.xml
@@ -275,6 +275,13 @@
         feature is enabled, the time interval specified here should be equal to
         or longer than the value specified for <code>maxIdleBackup</code>. By
         default, this feature is disabled.</p>
+        <p>If this feature is enabled, the <code>sessionActivityCheck</code>
+        attribute is forced to be true to ensure that currently active sessions
+        are not swapped out.</p>
+        <p>If this feature is enabled at runtime, e.g. via JMX, and session
+        activity was not being tracked prior to the feature being enabled, only
+        sessions created after the feature is enabled will be eligible for swap
+        out.</p>
       </attribute>
 
       <attribute name="minIdleSwap" required="false">
@@ -284,6 +291,13 @@
         swapped out to keep the active session count down. If specified, this
         value should be less than that specified by <code>maxIdleSwap</code>.
         By default, this value is set to <code>-1</code>.</p>
+        <p>If this feature is enabled, the <code>sessionActivityCheck</code>
+        attribute is forced to be true to ensure that currently active sessions
+        are not swapped out.</p>
+        <p>If this feature is enabled at runtime, e.g. via JMX, and session
+        activity was not being tracked prior to the feature being enabled, only
+        sessions created after the feature is enabled will be eligible for swap
+        out.</p>
       </attribute>
 
       <attribute name="persistAuthentication" required="false">