Automatic Session Save in Transaction.py

--===============0246637442942676843==
Content-Type: multipart/alternative; boundary=90e6ba4761af4b314c049d862df9

--90e6ba4761af4b314c049d862df9
Content-Type: text/plain; charset=ISO-8859-1

Hi,
We ran across an interesting problem with sessions being automatically saved
by Transaction.py. We had a situation where two AJAX requests were issued
and one of the requests updates the session and it started and completed
within the lifetime of another request. In that scenario the completion of
the first request overwrites the session and the changes to the session made
by the shorter request are lost.

Here's an easier to follow timeline:
Request 1 - reads session (assume session is empty)
Request 2 - reads session (assume session is empty)
Request 2 - adds data to session
Request 2 - sleep() called - session is stored (session contains data)
Request 1 - sleep() called - session is stored (session is now empty - the
value of the session when Request 1 read it)

So when later requests go to read the data stored in the session by request
2 the data isn't there.

Here's the code from WebKit.Transaction:
def sleep(self):
"""Send sleep() to the session and the servlet.

Note that sleep() is sent in reverse order as awake()
(which is typical for shutdown/cleanup methods).

"""
self._nested -= 1
self._servlet.sleep(self)
if not self._nested and self._session:
self._session.sleep(self)
self._application.sessions().storeSession(self._session)

We put a hack in the longer running AJAX page's sleep() to keep the session
from being stored since it doesn't modify the session:
def sleep(self, trans):
    trans._session = None

Is there an official way to disable the automatic storage of sessions?

If not there are a number of ways to resolve this problem more generally:
- Explicit session saves by servlet - Transaction never calls storeSession()
- Explicit opt in/opt out of session storage by servlet
- Explicit opt in/opt out of session storage by AppConfig
- Extend Session functionality to keep a "dirty" flag and only automatically
save the session if it has been modified during the request/response.

IMO Webware shouldn't be saving the session automatically at the end of each
request. I'd rather the servlet logic explicitly decide when and if to save
the session, but this would break backward compatibility. I'd be happy to
supply a patch if we can decide on a way forward.

Best Regards,
Steve
Blog: http://tech.agilitynerd.com/

--90e6ba4761af4b314c049d862df9
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi,<div>We ran across an interesting problem with sessions being automatica=
lly saved by Transaction.py. We had a situation where two AJAX requests wer=
e issued and one of the requests updates the session and it started and com=
pleted within the lifetime of another request. In that scenario the complet=
ion of the first request overwrites the session and the changes to the sess=
ion made by the shorter request are lost.=A0</div>
<div><br></div><div>Here&#39;s an easier to follow timeline:</div><div>Requ=
est 1 - reads session (assume session is empty)</div><div>Request 2 - reads=
 session=A0(assume session is empty)</div><meta http-equiv=3D"content-type"=
 content=3D"text/html; charset=3Dutf-8"><div>
Request 2 - adds data to session</div><div>Request 2 - sleep() called - ses=
sion is stored (session contains data)</div><div>Request 1 -=A0<meta http-e=
quiv=3D"content-type" content=3D"text/html; charset=3Dutf-8">sleep() called=
 - session is stored (session is now empty - the value of the session when =
Request 1 read it)<br clear=3D"all">
<br></div><div>So when later requests go to read the data stored in the ses=
sion by request 2 the data isn&#39;t there.</div><div><br></div><div>Here&#=
39;s the code from WebKit.Transaction:</div><div><div><span class=3D"Apple-=
tab-span" style=3D"white-space:pre">	</span>def sleep(self):</div>
<div><span class=3D"Apple-tab-span" style=3D"white-space:pre">		</span>&quo=
t;&quot;&quot;Send sleep() to the session and the servlet.</div><div><br></=
div><div><span class=3D"Apple-tab-span" style=3D"white-space:pre">		</span>=
Note that sleep() is sent in reverse order as awake()</div>
<div><span class=3D"Apple-tab-span" style=3D"white-space:pre">		</span>(whi=
ch is typical for shutdown/cleanup methods).</div><div><br></div><div><span=
 class=3D"Apple-tab-span" style=3D"white-space:pre">		</span>&quot;&quot;&q=
uot;</div>
<div><span class=3D"Apple-tab-span" style=3D"white-space:pre">		</span>self=
._nested -=3D 1</div><div><span class=3D"Apple-tab-span" style=3D"white-spa=
ce:pre">		</span>self._servlet.sleep(self)</div><div><span class=3D"Apple-t=
ab-span" style=3D"white-space:pre">		</span>if not self._nested and self._s=
ession:</div>
<div><span class=3D"Apple-tab-span" style=3D"white-space:pre">			</span>sel=
f._session.sleep(self)</div><div><span class=3D"Apple-tab-span" style=3D"wh=
ite-space:pre">			</span>self._application.sessions().storeSession(self._se=
ssion)</div>
</div><div><br></div><div>We put a hack in the longer running AJAX page&#39=
;s sleep() to keep the session from being stored since it doesn&#39;t modif=
y the session:</div><div>def sleep(self, trans):</div><div>=A0=A0 =A0trans.=
_session =3D None</div>
<div><br></div><div>Is there an official way to disable the automatic stora=
ge of sessions?</div><div><br></div><div>If not there are a number of ways =
to resolve this problem more generally:</div><div>- Explicit session saves =
by servlet - Transaction never calls storeSession()</div>
<div>- Explicit opt in/opt out of session storage by servlet</div><div>- Ex=
plicit opt in/opt out of session storage by AppConfig</div><div>- Extend Se=
ssion functionality to keep a &quot;dirty&quot; flag and only automatically=
 save the session if it has been modified during the request/response.</div=
>
<div><br></div><div>IMO Webware shouldn&#39;t be saving the session automat=
ically at the end of each request. I&#39;d rather the servlet logic explici=
tly decide when and if to save the session, but this would break backward c=
ompatibility. I&#39;d be happy to supply a patch if we can decide on a way =
forward.<br>
</div><div><br>Best Regards,<br>
Steve<br>
Blog: <a href=3D"http://tech.agilitynerd.com/" target=3D"_blank">http://tec=
h.agilitynerd.com/</a><br><br>
</div>

--90e6ba4761af4b314c049d862df9--


--===============0246637442942676843==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Free Software Download: Index, Search & Analyze Logs and other IT data in 
Real-Time with Splunk. Collect, index and harness all the fast moving IT data 
generated by your applications, servers and devices whether physical, virtual
or in the cloud. Deliver compliance at lower cost and gain new business 
insights. http://p.sf.net/sfu/splunk-dev2dev 
--===============0246637442942676843==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Webware-discuss mailing list
Webware-discuss-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/webware-discuss

--===============0246637442942676843==--