[TC 4.0/4.1] - Recycling session objects is inherently error prone

[Arvind Srinivasan <ar...@sun.com>]

Since the lifetime of session objects span requests and since session
objects are expired asynchronously by the background thread created by
the session manager, if one did recycle session objects then isn't it
possible for 2 separate requests to access and possibly modify a session
object simultaneously ?

 - Request 1 gets access to a session (session-timeout = 1 minute)
 - Request 1 then does some operations that take a couple of
   minutes
 - The session manager thread expires the session and recycles
   the session object
 - Request 2 asks for a session and gets a reference to the recycled
   session object and starts using it
 - Request 1's database operations complete and it too uses the
   session
 
o.a.c.session.ManagerBase has an ArrayList 'recycled' that is used for
recycling session objects. 4.0.x never uses this because manager is set
to null in StandardSession.recycle() and hence ManagerBase.recycle() is
never invoked. 4.1 however, does recycle sessions and does run into the
problem described in the above scenario when running a session based
load on a multi-cpu box.

If this is indeed a problem, I can submit a patch that removes the
session recycling code.

Thanks,
 Arvind

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>