Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-2184

SessionListenerBridge doesn't properly implement sessionIdChanged

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • 2.3.1.Final, 2.2.22.Final
    • 2.2.17.Final
    • Servlet
    • None
    • Hide

      Deploy an application in WildFly (I'm using version 26.1.1), with an HttpSessionIdListener registered via web.xml which simply logs any calls made to its sessionIdChanged method.

      By inspecting the httpSessionIdListeners on the applicationListeners on the SessionListenerBridge, you can confirm that the listener has successfully been registered.

      Trigger a sessionId change by logging into the application.  You can confirm from the undertow logging that a session id does get changed:

      DEBUG [io.undertow.session] (default task-2) Changing session id 17bHjRwMP_dYGAL0DEssijYYw3cb6qKBlLf3AKk1 to 28BBAuRjAGR2Tncxa3uTpYiJzF1o-uGz0lvQow_9

      However, see from the lack of logging that listener's sessionIdChanged method never gets called.

       

      Show
      Deploy an application in WildFly (I'm using version 26.1.1), with an HttpSessionIdListener registered via web.xml which simply logs any calls made to its sessionIdChanged method. By inspecting the httpSessionIdListeners on the applicationListeners on the SessionListenerBridge, you can confirm that the listener has successfully been registered. Trigger a sessionId change by logging into the application.  You can confirm from the undertow logging that a session id does get changed: DEBUG [io.undertow.session] (default task-2) Changing session id 17bHjRwMP_dYGAL0DEssijYYw3cb6qKBlLf3AKk1 to 28BBAuRjAGR2Tncxa3uTpYiJzF1o-uGz0lvQow_9 However, see from the lack of logging that listener's sessionIdChanged method never gets called.  

      The implementation of sessionIdChanged in SessionListenerBridge is empty:

          @Override
          public void sessionIdChanged(Session session, String oldSessionId) {
          } 

      Compare that for example to the implementation of sessionCreated:

          @Override
          public void sessionCreated(final Session session, final HttpServerExchange exchange) {
              final HttpSessionImpl httpSession = SecurityActions.forSession(session, servletContext, true);
              applicationListeners.sessionCreated(httpSession);
          } 

      I suspect that the empty sessionIdChanged method is supposed to be calling applicationListeners.httpSessionIdChanged.

      As it stands, when I register a HttpSessionIdListener, its sessionIdChanged never gets called.

              rhn-cservice-bbaranow Bartosz Baranowski
              paulthomson Paul Thomson (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: