You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2025/09/10 10:42:50 UTC
[Bug 69814] New: HttpSession.isNew() may return true on an existing session due to a race condition
https://bz.apache.org/bugzilla/show_bug.cgi?id=69814
Bug ID: 69814
Summary: HttpSession.isNew() may return true on an existing
session due to a race condition
Product: Tomcat 10
Version: 10.1.44
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
Assignee: dev@tomcat.apache.org
Reporter: csammy@gmail.com
Target Milestone: ------
In a stateful application where HttpSession is used, session.isNew() should
return true in the request where the session is just created anew; and false
when it is retrieved from an existing one. However, very infrequently, it could
return TRUE under some particular execution sequence as follows:
1) Client sends the 1st request
2) Server receives the 1st request and processes it in thread T1. Session S is
created. Its "isnew" field is set to true. Response is flushed. T1 is paused
(e.g. due to context switching) before calling StandardSession.endAccess().
3) Client receives the response, including the JSESSIONID
4) Client sends the 2nd request with the JSESSIONID
5) Server receives the 2nd request and processes it in thread T2.
StandardManager finds the session S using the given JSESSIONID successfully.
The application calls session.isNew() which unexpectedly returns TRUE. Response
is then returned to client
6) Server's thread T1 continues to run StandardSession.endAccess() after
outputting the response, which set the session S's isnew field to false:
https://github.com/apache/tomcat/blob/10.1.45/java/org/apache/catalina/session/StandardSession.java#L535
(also see the attached thread dump 1st_request_thread_dump.txt)
7) In subsequent requests, isnew() returns false as expected.
Normally, session.isNew() is false if 6) occurs before 5), but when the server
is slow or client is too fast, the above sequence will trigger the bug. I could
easily reproduce it on Linux and Windows with the help of a debugger to enforce
such a sequence.
How to reproduce:
Set a breakpoint to pause at StandardSession.endAccess() and fire two requests
successively.
1) Deploy the attached demo application (attached TomcatApp.war):
set JAVA_OPTS in startup.sh/.bat script to enable remote debugging:
JAVA_OPTS=-agentlib:jdwp=transport=dt_socket,address=*:9999,server=y,suspend=n"
override the conf/server.xml with the attached that sets the listening port to
9080 and disables TLS redirection.
2) Open the demo project (attached TomcatHello.zip) in IntelliJ IDEA
3) Set breakpoint at StandardSession.endAccess()
4) Set remote JVM debug to localhost:9999
5) Open a console
6) Run the following in sequence:
curl -c cookies.txt http://localhost:9080/TomcatApp/hello
(breakpoint hit)
(output: Session isNew? true)
curl -b cookies.txt http://localhost:9080/TomcatApp/hello
(output: Session isNew? true)
(Detach the debugger)
curl -b cookies.txt http://localhost:9080/TomcatApp/hello
(output: Session isNew? false)
(See also the attached video demo.mp4)
Regards,
Sammy Chan
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69814] HttpSession.isNew() may return true on an existing session due to a race condition
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69814
--- Comment #3 from Mark Thomas <ma...@apache.org> ---
The Javadoc for HttpSession.isNew() is interesting.
<quote>
Returns true if the client does not yet know about the session or if the client
chooses not to join the session.
</quote>
Given that the server can only tell what the client has chosen if the client
returns the session ID to the server that might as well be:
"Returns true until the client chooses to join the session."
Which means that, if this were fixed, you'd have the inverse of this bug where,
once the second request has been received, session.isNew() in the first request
would return false.
I think that is consistent with the current Javadoc for HttpSession.isNew() and
also looks to be simple to implement.
I'll start work on a test case with a viw to fixing this as proposed. As soon
as the second request is received (and the session ID has been processed)
isNew() will start returning true.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69814] HttpSession.isNew() may return true on an existing session due to a race condition
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69814
--- Comment #1 from Sammy Chan <cs...@gmail.com> ---
Created attachment 40098
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40098&action=edit
demo source, app, video
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69814] HttpSession.isNew() may return true on an existing session due to a race condition
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69814
Sammy Chan <cs...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
OS| |All
--- Comment #2 from Sammy Chan <cs...@gmail.com> ---
Could I use the following as a temporary substitution for session.isNew()?
boolean isNew = session.getCreateionTime() == session.getLastAccessedTime();
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69814] HttpSession.isNew() may return true on an existing session due to a race condition
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69814
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|NEW |RESOLVED
--- Comment #4 from Mark Thomas <ma...@apache.org> ---
Fixed in:
- 11.0.x for 11.0.12 onwards
- 10.1.x for 10.1.47 onwards
- 9.0.x for 9.0.110 onwards
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org