SesionID is null exception

[NabbleSometimesSucks <bi...@yahoo.com>]

I see this a number of times when I am testing. I shut down my server and
restart it after making some coding changes then when my web app redeploys
and the browser shows up I see.

javax.servlet.ServletException: Filtered request failed.

org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:384)

org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)

org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)

org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
root cause

java.lang.IllegalArgumentException: The
org.apache.shiro.session.mgt.DelegatingSession implementation requires that
the SessionKey argument returns a non-null sessionId to support the
Session.getId() invocations.

org.apache.shiro.session.mgt.DelegatingSession.<init>(DelegatingSession.java:70)

org.apache.shiro.web.session.mgt.DefaultWebSessionManager.createExposedSession(DefaultWebSessionManager.java:166)

org.apache.shiro.session.mgt.AbstractNativeSessionManager.getSession(AbstractNativeSessionManager.java:98)

org.apache.shiro.mgt.SessionsSecurityManager.getSession(SessionsSecurityManager.java:125)

org.apache.shiro.mgt.DefaultSecurityManager.resolveContextSession(DefaultSecurityManager.java:456)

org.apache.shiro.mgt.DefaultSecurityManager.resolveSession(DefaultSecurityManager.java:442)

org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:338)
	org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:846)

org.apache.shiro.web.subject.WebSubject$Builder.buildWebSubject(WebSubject.java:148)

org.apache.shiro.web.servlet.AbstractShiroFilter.createSubject(AbstractShiroFilter.java:292)

org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:359)

org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)

org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)

org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)

Not sure why. But the only fix is to go into browser developer and clear out
the cookies. That is fine for me as the developer, but not for actual users
when we go to production. So I need to figure out what causes this and fix
it.

Thanks

Mark



--
View this message in context: http://shiro-user.582556.n2.nabble.com/SesionID-is-null-exception-tp7578406.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: SesionID is null exception

[NabbleSometimesSucks <bi...@yahoo.com>]

This issue might be closely related to what Bernhard is seeing too. I don't
know something about his post that sounds familiar, all dealing with
SessionID.

"Do you have a test that can re-create the issue so I can troubleshoot? "

Don't they all always ask that question. If I could isolate to that level,
then I could debug and figure it out. Unfortunately, except for giving you
our entire project (Which we can't, maybe one day we can fly you out to
Vegas), there is no way to get to that level. I am sorry.

I have though been debugging through Shiro code while the error occurs, and
it is completely baffling. Basically what I have noticed that seemed
interesting at the time.

1) Stepping through the DefaultWebSecurityManager where it tries to create a
SubjectContext and getSessionId. The context's sessionId is being set to
null, when the error occurs.

However, in the DefaultSessionManager, it is somehow coming up with a
SessionID. But never uses it to populate the SubjectContext.

I am also wondering if my customization causes this in some odd way, but I
have done so much that I am lost at what might have cause it. Here is my
Spring configuration for SessionManager and SessionDAO



So what that says to me, is that in all cases regarding Sessions, it will
always only store in the cacheManager, which is our custom CacheManager
which returns a custom Cache implementation which writes to Redis.

Wait, thought Sessions themselves in this environment would be HttpSessions
stored via Tomcat. So if I restart Tomcat, and there is a lingering cookie
for sessionID in the browser for a previous session in the old run of
Tomcat, then any attempt to look up that sessionID would result it not
finding it in Tomcat. Then trying to look in the Cache for it. But in the
cache/Redis that entry could be gone. Maybe because of a Time To live or
something else.

But I would also assume that if you can't find any sessionId in Tomcat or
the cache that it would automatically generate a new SessionId and then just
use that???

Just ideas.

Mark



--
View this message in context: http://shiro-user.582556.n2.nabble.com/SesionID-is-null-exception-tp7578406p7578415.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: SesionID is null exception

[Les Hazlewood <lh...@apache.org>]

This is very odd - if you have a sessionId cookie, this logic should
work perfectly well.  It appears that something is interfering with
the DefaultWebSessionManager's ability to acquire a session ID, but I
can't tell what triggers this state by a stack trace alone.

Do you have a test that can re-create the issue so I can troubleshoot?

Les

On Thu, Mar 14, 2013 at 9:06 PM, NabbleSometimesSucks
<bi...@yahoo.com> wrote:
> I see this a number of times when I am testing. I shut down my server and
> restart it after making some coding changes then when my web app redeploys
> and the browser shows up I see.
>
> javax.servlet.ServletException: Filtered request failed.
>
> org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:384)
>
> org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
>
> org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
>
> org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
> root cause
>
> java.lang.IllegalArgumentException: The
> org.apache.shiro.session.mgt.DelegatingSession implementation requires that
> the SessionKey argument returns a non-null sessionId to support the
> Session.getId() invocations.
>
> org.apache.shiro.session.mgt.DelegatingSession.<init>(DelegatingSession.java:70)
>
> org.apache.shiro.web.session.mgt.DefaultWebSessionManager.createExposedSession(DefaultWebSessionManager.java:166)
>
> org.apache.shiro.session.mgt.AbstractNativeSessionManager.getSession(AbstractNativeSessionManager.java:98)
>
> org.apache.shiro.mgt.SessionsSecurityManager.getSession(SessionsSecurityManager.java:125)
>
> org.apache.shiro.mgt.DefaultSecurityManager.resolveContextSession(DefaultSecurityManager.java:456)
>
> org.apache.shiro.mgt.DefaultSecurityManager.resolveSession(DefaultSecurityManager.java:442)
>
> org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:338)
>         org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:846)
>
> org.apache.shiro.web.subject.WebSubject$Builder.buildWebSubject(WebSubject.java:148)
>
> org.apache.shiro.web.servlet.AbstractShiroFilter.createSubject(AbstractShiroFilter.java:292)
>
> org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:359)
>
> org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
>
> org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
>
> org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
>
> Not sure why. But the only fix is to go into browser developer and clear out
> the cookies. That is fine for me as the developer, but not for actual users
> when we go to production. So I need to figure out what causes this and fix
> it.
>
> Thanks
>
> Mark
>
>
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/SesionID-is-null-exception-tp7578406.html
> Sent from the Shiro User mailing list archive at Nabble.com.