[picocontainer-dev] A plea for removal of session container for Pico-Web 3
"Michael Rimov" <[email protected]> Thu, 15 Mar 2012 14:35:48 -0700
| Newsgroups | gmane.comp.java.picocontainer.devel |
|---|---|
| Organization | Centerline Computers, Inc. |
| Message-ID | <[email protected]> |
------=_NextPart_000_0019_01CD02B8.EA0CAE30
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Paul, et al,
I know the session container is convenient. But frankly, it has problems
that IMO do not make it worthwhile:
1. It's too easy for newbies to cause memory leaks by referencing the
app-level container in their objects. We don't want to help people hang
themselves.
2. Forced session creation makes it very easy to "DOS" a public
webserver by simply having a bot check for requests and discard the session
cookie. New session created each time until the server runs out of memory.
(And yes, I forgot to set session="false" on a jsp home page for a client,
and that's exactly what happened. a bot from the Ukraine repeatedly hit the
same page, and down the server went)
Now if I'm misunderstanding the mechanics on point 2, I'm cool with
repentance for posting this :-) Otherwise, I'd REALLY like to see this
feature removed.
Thanks for listening :)
-Mike
------=_NextPart_000_0019_01CD02B8.EA0CAE30
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 14 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:634063575;
mso-list-type:hybrid;
mso-list-template-ids:-197911810 67698703 67698713 67698715 67698703 =
67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue =
vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal>Paul, =
<i>et al</i>,<o:p></o:p></p><p class=3DMsoNormal><o:p> </o:p></p><p =
class=3DMsoNormal>I know the session container is convenient. But =
frankly, it has problems that IMO do not make it =
worthwhile:<o:p></o:p></p><p class=3DMsoNormal><o:p> </o:p></p><p =
class=3DMsoListParagraph style=3D'text-indent:-.25in;mso-list:l0 level1 =
lfo1'><![if !supportLists]><span style=3D'mso-list:Ignore'>1.<span =
style=3D'font:7.0pt "Times New =
Roman"'> =
</span></span><![endif]>It’s too easy for newbies to cause memory =
leaks by referencing the app-level container in their objects. We =
don’t want to help people hang themselves.<o:p></o:p></p><p =
class=3DMsoListParagraph style=3D'text-indent:-.25in;mso-list:l0 level1 =
lfo1'><![if !supportLists]><span style=3D'mso-list:Ignore'>2.<span =
style=3D'font:7.0pt "Times New =
Roman"'> =
</span></span><![endif]>Forced session creation makes it very easy to =
“DOS” a public webserver by simply having a bot check for =
requests and discard the session cookie. New session created each =
time until the server runs out of memory. (And yes, I forgot to =
set session=3D”false” on a jsp home page for a client, and =
that’s exactly what happened… a bot from the Ukraine =
repeatedly hit the same page, and down the server went)<o:p></o:p></p><p =
class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>Now if =
I’m misunderstanding the mechanics on point 2, I’m cool with =
repentance for posting this :-) Otherwise, I’d REALLY like =
to see this feature removed.<o:p></o:p></p><p =
class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>Thanks for =
listening :)<o:p></o:p></p><p class=3DMsoNormal><o:p> </o:p></p><p =
class=3DMsoNormal> &=
nbsp; &n=
bsp; &nb=
sp; &nbs=
p;  =
; =
&=
nbsp; &n=
bsp; &nb=
sp; &nbs=
p;  =
; =
-Mike<o:p></o:p></p><p class=3DMsoNormal> <o:p></o:p></p><p =
class=3DMsoNormal><o:p> </o:p></p><p =
class=3DMsoNormal><o:p> </o:p></p></div></body></html>
------=_NextPart_000_0019_01CD02B8.EA0CAE30--