(tomcat) branch 11.0.x updated: Prevent session swap out if associated with currently active request

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/11.0.x by this push:
     new 7c7b6482b5 Prevent session swap out if associated with currently active request
7c7b6482b5 is described below

commit 7c7b6482b5744593fc8a8a2723711b3c9ff97d2f
Author: Mark Thomas <[email protected]>
AuthorDate: Mon Aug 24 08:58:59 2026 +0100

    Prevent session swap out if associated with currently active request
---
 .../apache/catalina/session/PersistentManagerBase.java    | 15 ++++++++++-----
 webapps/docs/changelog.xml                                |  7 +++++++
 webapps/docs/config/manager.xml                           | 14 ++++++++++++++
 3 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/java/org/apache/catalina/session/PersistentManagerBase.java b/java/org/apache/catalina/session/PersistentManagerBase.java
index ee9ef331d3..9c26fd0445 100644
--- a/java/org/apache/catalina/session/PersistentManagerBase.java
+++ b/java/org/apache/catalina/session/PersistentManagerBase.java
@@ -286,9 +286,14 @@ public abstract class PersistentManagerBase extends ManagerBase implements Store
     }
 
 
-    // --------------------------------------------------------- Public Methods
+    @Override
+    public boolean getSessionActivityCheck() {
+        return super.getSessionActivityCheck() || minIdleSwap > -1 || maxIdleSwap > -1;
+    }
 
 
+    // --------------------------------------------------------- Public Methods
+
     /**
      * Clear all sessions from the Store.
      */
@@ -783,8 +788,8 @@ public abstract class PersistentManagerBase extends ManagerBase implements Store
                 }
                 int timeIdle = (int) (session.getIdleTimeInternal() / 1000L);
                 if (timeIdle >= maxIdleSwap && timeIdle >= minIdleSwap) {
-                    if (session.accessCount != null && session.accessCount.get() > 0) {
-                        // Session is currently being accessed - skip it
+                    if (session.accessCount == null || session.accessCount.get() > 0) {
+                        // Session access is not tracked or session is currently being accessed - skip it
                         continue;
                     }
                     if (log.isTraceEnabled()) {
@@ -831,8 +836,8 @@ public abstract class PersistentManagerBase extends ManagerBase implements Store
             synchronized (session) {
                 int timeIdle = (int) (session.getIdleTimeInternal() / 1000L);
                 if (timeIdle >= minIdleSwap) {
-                    if (session.accessCount != null && session.accessCount.get() > 0) {
-                        // Session is currently being accessed - skip it
+                    if (session.accessCount == null || session.accessCount.get() > 0) {
+                        // Session access is not tracked or session is currently being accessed - skip it
                         continue;
                     }
                     if (log.isTraceEnabled()) {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 7defa4636b..b10dfe2dab 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -148,6 +148,13 @@
         default method implementation provided only provides the pre-fix
         functionality. (markt)
       </fix>
+      <fix>
+        Ensure that <code>PersistentManager</code> implementations that extend
+        <code>PersistentManagerBase</code> do not swap out sessions that are
+        associated with a request that is currently being processed. This
+        includes not swapping out a session unless the session was created when
+        activity tracking was enabled. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">
diff --git a/webapps/docs/config/manager.xml b/webapps/docs/config/manager.xml
index 7def5bd5d6..ce5a7c4891 100644
--- a/webapps/docs/config/manager.xml
+++ b/webapps/docs/config/manager.xml
@@ -272,6 +272,13 @@
         feature is enabled, the time interval specified here should be equal to
         or longer than the value specified for <code>maxIdleBackup</code>. By
         default, this feature is disabled.</p>
+        <p>If this feature is enabled, the <code>sessionActivityCheck</code>
+        attribute is forced to be true to ensure that currently active sessions
+        are not swapped out.</p>
+        <p>If this feature is enabled at runtime, e.g. via JMX, and session
+        activity was not being tracked prior to the feature being enabled, only
+        sessions created after the feature is enabled will be eligible for swap
+        out.</p>
       </attribute>
 
       <attribute name="minIdleSwap" required="false">
@@ -281,6 +288,13 @@
         swapped out to keep the active session count down. If specified, this
         value should be less than that specified by <code>maxIdleSwap</code>.
         By default, this value is set to <code>-1</code>.</p>
+        <p>If this feature is enabled, the <code>sessionActivityCheck</code>
+        attribute is forced to be true to ensure that currently active sessions
+        are not swapped out.</p>
+        <p>If this feature is enabled at runtime, e.g. via JMX, and session
+        activity was not being tracked prior to the feature being enabled, only
+        sessions created after the feature is enabled will be eligible for swap
+        out.</p>
       </attribute>
 
       <attribute name="persistAuthentication" required="false">