Does Action#isTokenValid method have a thread synchronization problem?

[FUJIMURA Hiroshi <fu...@isid.co.jp>]

Hi

HttpServletRequest#getSession() of Tomcat4.0.3 returns a different session instance.

For example, if you write following code in Action#perform or Action#execute:
  HttpSession session1 = req.getSession();
  HttpSession session2 = req.getSession();
  System.out.println("session1="+session1);
  System.out.println("session2="+session2);
  System.out.println(session1==session2);

you will get following result:
  session1=org.apache.catalina.session.StandardSessionFacade@7cd37a
  session1=org.apache.catalina.session.StandardSessionFacade@202d69
  false

 This means that the session instance returned by HttpServletRequest#getSession() 
can not be used as thread lock monitor. 
 But in Action#isTokenValid(HttpServletRequest request, boolean reset) of Struts1.1b, 
session instance is used as thread lock monitor.

Does this method work correctly when a submit button is quickly pushed twice?

Best regards,

/**
 * Hiroshi Fujimura
 * @e-mail   fujimura@isid.co.jp
 * @version  0.9.1b :-)
 */

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>