[jira] [Created] (SHIRO-452) SimpleSession serialization issue

["Bruno GRIEDER (JIRA)" <ji...@apache.org>]

Bruno GRIEDER created SHIRO-452:
-----------------------------------

             Summary: SimpleSession serialization issue
                 Key: SHIRO-452
                 URL: https://issues.apache.org/jira/browse/SHIRO-452
             Project: Shiro
          Issue Type: Bug
          Components: Caching , Session Management
    Affects Versions: 1.2.1
         Environment: Java 6 - EhCache 2.6.2
            Reporter: Bruno GRIEDER


We cache SimpleSession in EhCache which is configured with Overflow to Disk and an LRU eviction policy.

When the cache is full, EhCache will attempt to evict a session from the Disk Storage to reclaim space.
To evict the `SimpleSession`, EhCache will attempt to deserialize the eveicted session first. From time to time, the deserialization of the `SimpleSession` fails. When that happens the system is locked, since no additional session can be created.

`SimpleSession` has a custom serialization mechanism that calculates a bit mask which indicates which fields of the `SimpleSession` containing values. This bitMask is serialized first (as a Short) then the fields containing values.
When deserialization is failing, the bitMask indicates that the `attributes` Map contains data, however no `attributes` have actually been serialized and the deserialization fails with a `java.io.OptionalDataException`.

The discrepancy is very likely due to `attributes` being a non synchronized Map: the SimpleSession is created on a Servlet thread, however the serialization to Disk is performed by EhCache on one of its cache management threads.

SimpleSession fields should likely be marked as volatile and the Map should be a Synchronized Map or SimpleSession should be made immutable.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira