You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Dave <ja...@yahoo.com> on 2006/07/21 02:36:21 UTC
getSession() thread-safe? User A can see user B's account
Is the following method thread-safe?
I use my own way for authentication. After authenticated, a user info is put into session, when logout, call session.invalidate();
Current symptom is: a user info gets into another user's session. So sometimes User A can see User B's info.
The way to get session: is it thread-safe?
public static HttpSession getHttpSession(boolean create) {
FacesContext context = FacesContext.getCurrentInstance();
return (HttpSession)context.getExternalContext().getSession(create);
}
If a user clicks two buttons at the same time(two requests belong to one same session), will it be thread-safe?
Thanks for help.
---------------------------------
Yahoo! Music Unlimited - Access over 1 million songs.Try it free.
Re: getSession() thread-safe? User A can see user B's account
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Timothy,
>> I still don't understand how JSF knows which session you are requesting.
>> I'm sorry that I don't know a thing about JSF.
>
> That's OK, 'cause I'm not using JSF ;-)
Oh, sorry. I thought you had indicated that fact. IF you're using
straight-up servlet stuff, then I can certainly help.
> I'm just using Tomcat, and going on the assumption that when a session
> is created for a particular user, it remains for that user, at that
> location, until it times out or is otherwise destroyed/invalidated.
That is a correct assumption, as long as you are using
HttpServletRequest.getSession to get your sessions.
> If this assumption is incorrect....well, I'll clearly have to find
> *some* other way of identifying users. Cookies, maybe?
Tomcat uses cookies (or optionally, re-written URLs) to track users and
link them up with their sessions.
If you are having session crossover, it is likely to be due to one of
the following:
1. Incorrect or inappropriate use of
HttpServletRequest.getSession method, possibly including the use of
a static method in the servlet or a non-standard way of getting the
session.
2. Incorrect use of URL rewriting to track the user's session id.
3. Your own session implementation which has bugs. There aren't too
many good reasons to use your own session implementation.
4. Inappropriate storing of the session in another place, such as a
VM-global or server-global store, and then incorrectly retrieving
said session.
-chris
Re: getSession() thread-safe? User A can see user B's account
Posted by Timothy Collett <da...@mac.com>.
On Jul 21, 2006, at 10:27 AM, Christopher Schultz wrote:
> I still don't understand how JSF knows which session you are
> requesting.
> I'm sorry that I don't know a thing about JSF.
That's OK, 'cause I'm not using JSF ;-)
I'm just using Tomcat, and going on the assumption that when a
session is created for a particular user, it remains for that user,
at that location, until it times out or is otherwise destroyed/
invalidated.
If this assumption is incorrect....well, I'll clearly have to find
*some* other way of identifying users. Cookies, maybe?
Timothy Collett
--
"The grave's a fine and private place,
But none, I think, do there embrace."
—Andrew Marvell, "To His Coy Mistress"
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: getSession() thread-safe? User A can see user B's account
Posted by Mario Ivankovits <ma...@ops.co.at>.
Hi!
> I still don't understand how JSF knows which session you are requesting.
> I'm sorry that I don't know a thing about JSF.
>
Without going into any details, but JSF simply has a facesServlet which
get the session from the request and puts it in its internal structures.
So it simply takes what it gets from the container.
Ciao,
Mario
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: getSession() thread-safe? User A can see user B's account
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Timothy,
>> I think what's going on is that you have a global session, instead of
>> individual sessions. User A is not seeing User B's session: everyone is
>> seeing the /same/ session.
>
> From my earlier experiments, I believe that is *not* what is happening,
> at least in my case. I took the precaution of adding the ID of the
> HttpSession that created the UserSession object to its key, and stored
> it in the context attributes. I then had each UserSession print various
> information about itself to the console as it was worked with, and
> though *everything* else remained the same (apparently), including the
> session IDs, the username and test/live indicator were being changed
> somehow.
I still don't understand how JSF knows which session you are requesting.
I'm sorry that I don't know a thing about JSF.
-chris
Re: getSession() thread-safe? User A can see user B's account
Posted by Timothy Collett <da...@mac.com>.
On Jul 21, 2006, at 10:12 AM, Christopher Schultz wrote:
> I think what's going on is that you have a global session, instead of
> individual sessions. User A is not seeing User B's session:
> everyone is
> seeing the /same/ session.
From my earlier experiments, I believe that is *not* what is
happening, at least in my case. I took the precaution of adding the
ID of the HttpSession that created the UserSession object to its key,
and stored it in the context attributes. I then had each UserSession
print various information about itself to the console as it was
worked with, and though *everything* else remained the same
(apparently), including the session IDs, the username and test/live
indicator were being changed somehow.
Timothy Collett
--
You step in the stream,
But the water has moved on.
This page is not here.
~haiku~
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: getSession() thread-safe? User A can see user B's account
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Dave,
> It is very strange. I do not understand how a User object in Session
> A gets into Session B. It seems that after a session is expired or
> invalidated, that session is attached to another user's request.
I think what's going on is that you have a global session, instead of
individual sessions. User A is not seeing User B's session: everyone is
seeing the /same/ session.
Just a guess.
-chris
Re: getSession() thread-safe? User A can see user B's account
Posted by Pid <p...@pidster.com>.
Are you storing/defining these user details outside the doPost or doGet
methods of any of the servlets used to access them?
the only way that these details will (should, could) be shared across
different user sessions are if the session hasn't been properly
invalidated or cleared, and the user logs in at the same machine, or if
you've defined or stored them in a static variable or variable outside
of the threaded methods used to access and manipulate them.
private String username;
doGet(...) throws ... {
// do stuff with 'username'
}
Timothy Collett wrote:
> On Jul 21, 2006, at 9:50 AM, Dave wrote:
>
>> Hi Tim,
>>
>> It is very strange. I do not understand how a User object in Session
>> A gets into Session B. It seems that after a session is expired or
>> invalidated, that session is attached to another user's request.
>> Just one guess.
>>
>> Please share more when you find anything.
>
> Well, one thing I can remember from my previous experiments is that it
> wasn't invalidated sessions--it was current sessions. Also, I was
> primarily using JSPs (which, from my understanding, are essentially
> compiled into servlets), rather than Faces, so I can access the request
> directly.
>
> I believe what I did was something like the following:
>
> Log in with User A
> Log in with User B
> Do something with User A
>
> At this point, User A had User B's username, and if User B had switched
> from live to test data, User A would have been bumped to test, as well.
>
> When I have some more time, I'll re-run the experiments and confirm this.
>
> Timothy Collett
>
> --
>
> "Reality is merely an illusion, albeit a very persistent one "
> --Albert Einstein
>
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: getSession() thread-safe? User A can see user B's account
Posted by Timothy Collett <da...@mac.com>.
On Jul 21, 2006, at 9:50 AM, Dave wrote:
> Hi Tim,
>
> It is very strange. I do not understand how a User object in
> Session A gets into Session B. It seems that after a session is
> expired or invalidated, that session is attached to another user's
> request.
> Just one guess.
>
> Please share more when you find anything.
Well, one thing I can remember from my previous experiments is that
it wasn't invalidated sessions--it was current sessions. Also, I was
primarily using JSPs (which, from my understanding, are essentially
compiled into servlets), rather than Faces, so I can access the
request directly.
I believe what I did was something like the following:
Log in with User A
Log in with User B
Do something with User A
At this point, User A had User B's username, and if User B had
switched from live to test data, User A would have been bumped to
test, as well.
When I have some more time, I'll re-run the experiments and confirm
this.
Timothy Collett
--
"Reality is merely an illusion, albeit a very persistent one "
--Albert Einstein
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: getSession() thread-safe? User A can see user B's account
Posted by Dave <ja...@yahoo.com>.
Hi Tim,
It is very strange. I do not understand how a User object in Session A gets into Session B. It seems that after a session is expired or invalidated, that session is attached to another user's request.
Just one guess.
Please share more when you find anything.
Thanks,
Dave
Timothy Collett <da...@mac.com> wrote:
On Jul 20, 2006, at 8:36 PM, Dave wrote:
> Is the following method thread-safe?
>
> I use my own way for authentication. After authenticated, a user
> info is put into session, when logout, call session.invalidate();
>
> Current symptom is: a user info gets into another user's
> session. So sometimes User A can see User B's info.
Actually, I'm seeing something very similar, and it's a good thing my
webapp is only in testing, or it would, indeed, be causing problems...
I've got custom User and UserSession classes for tracking users in
general and logged-in users, respectively. For the moment, the main
symptoms of the problem are that the username field and the test/live
data field are getting munged between users somehow. I've tried to
trace it, and haven't been able to determine the mechanism by which
it happens. It's also somewhat disturbing that it's just those two
fields, and none of the rest of them.
I'll try and take another look, recreate my last experiments with the
problem, and come back with some more detailed information.
Timothy Collett
--
Chaos reigns within.
Reflect, repent, and reboot.
Order shall return.
~haiku~
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------
See the all-new, redesigned Yahoo.com. Check it out.
Re: getSession() thread-safe? User A can see user B's account
Posted by Timothy Collett <da...@mac.com>.
On Jul 20, 2006, at 8:36 PM, Dave wrote:
> Is the following method thread-safe?
>
> I use my own way for authentication. After authenticated, a user
> info is put into session, when logout, call session.invalidate();
>
> Current symptom is: a user info gets into another user's
> session. So sometimes User A can see User B's info.
Actually, I'm seeing something very similar, and it's a good thing my
webapp is only in testing, or it would, indeed, be causing problems...
I've got custom User and UserSession classes for tracking users in
general and logged-in users, respectively. For the moment, the main
symptoms of the problem are that the username field and the test/live
data field are getting munged between users somehow. I've tried to
trace it, and haven't been able to determine the mechanism by which
it happens. It's also somewhat disturbing that it's just those two
fields, and none of the rest of them.
I'll try and take another look, recreate my last experiments with the
problem, and come back with some more detailed information.
Timothy Collett
--
Chaos reigns within.
Reflect, repent, and reboot.
Order shall return.
~haiku~
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: getSession() thread-safe? User A can see user B's account
Posted by Len Popp <le...@gmail.com>.
On 7/21/06, Christopher Schultz <ch...@christopherschultz.net> wrote:
> Dave,
>
> > I am using JSF (apache faces). The way to get Session or
> > HttpServletRequest from a backing bean is through FacesContext.
> > Backing beans are not servlet, so can not access HttpServletRequest
> > directly.
> >
> > After synchronizing the method, I still got the same problem.
>
> Synchronization is not the problem: the lack of any identifying piece of
> information is the problem. You have to have a way to identify which
> user you are working with in order to get the session.
>
> > public static HttpSession getHttpSession(boolean create) {
> > FacesContext context = FacesContext.getCurrentInstance();
> > return (HttpSession)context.getExternalContext().getSession(create);
> > }
>
> There is no information about the user, here. How does
> FacesContext.getSession know which session to get?!
>
> > It is in production stage and users are starting to use it. I am very
> > nervous.
>
> You certainly cannot think about going live with such a bad bug. What is
> the product?
>
> -chris
>
According to the JSF documentation, FacesContext.getCurrentInstance
and ExternalContext.getSession are supposed to return information
about the current request, i.e. "the request that is being processed
by the current thread". I haven't used JSF myself so I can't say if
there's a problem getting the session that way, but it looks correct
at first glance.
References:
http://java.sun.com/javaee/javaserverfaces/1.0/docs/api/javax/faces/context/FacesContext.html
http://java.sun.com/javaee/javaserverfaces/1.0/docs/api/javax/faces/context/ExternalContext.html
--
Len
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: getSession() thread-safe? User A can see user B's account
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Dave,
> I am using JSF (apache faces). The way to get Session or
> HttpServletRequest from a backing bean is through FacesContext.
> Backing beans are not servlet, so can not access HttpServletRequest
> directly.
>
> After synchronizing the method, I still got the same problem.
Synchronization is not the problem: the lack of any identifying piece of
information is the problem. You have to have a way to identify which
user you are working with in order to get the session.
> public static HttpSession getHttpSession(boolean create) {
> FacesContext context = FacesContext.getCurrentInstance();
> return (HttpSession)context.getExternalContext().getSession(create);
> }
There is no information about the user, here. How does
FacesContext.getSession know which session to get?!
> It is in production stage and users are starting to use it. I am very
> nervous.
You certainly cannot think about going live with such a bad bug. What is
the product?
-chris
Re: getSession() thread-safe? User A can see user B's account
Posted by Dave <ja...@yahoo.com>.
Hi Chris,
I am using JSF (apache faces). The way to get Session or HttpServletRequest from a backing bean is through FacesContext. Backing beans are not servlet, so can not access HttpServletRequest directly.
After synchronizing the method, I still got the same problem.
It is in production stage and users are starting to use it. I am very nerveous.
Thanks!
Dave
Christopher Schultz <ch...@christopherschultz.net> wrote:
DAve,
> Current symptom is: a user info gets into another user's session. So
> sometimes User A can see User B's info.
>
> The way to get session: is it thread-safe?
>
> public static HttpSession getHttpSession(boolean create) {
> FacesContext context = FacesContext.getCurrentInstance(); return
> (HttpSession)context.getExternalContext().getSession(create); }
A static getHttpSession method is almost sure to cause problems. Why are
you not using HttpServletRequest.getSession? This method accepts no
information from the caller that identifies the user trying to get their
session. How do you identify users or sessions? Where is the session id?
-chris
---------------------------------
Yahoo! Music Unlimited - Access over 1 million songs.Try it free.
Re: getSession() thread-safe? User A can see user B's account
Posted by Christopher Schultz <ch...@christopherschultz.net>.
DAve,
> Current symptom is: a user info gets into another user's session. So
> sometimes User A can see User B's info.
>
> The way to get session: is it thread-safe?
>
> public static HttpSession getHttpSession(boolean create) {
> FacesContext context = FacesContext.getCurrentInstance(); return
> (HttpSession)context.getExternalContext().getSession(create); }
A static getHttpSession method is almost sure to cause problems. Why are
you not using HttpServletRequest.getSession? This method accepts no
information from the caller that identifies the user trying to get their
session. How do you identify users or sessions? Where is the session id?
-chris