Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-2184

SessionListenerBridge doesn't properly implement sessionIdChanged

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • 2.3.1.Final, 2.2.22.Final
    • 2.2.17.Final
    • Servlet
    • None
    • Hide

      Deploy an application in WildFly (I'm using version 26.1.1), with an HttpSessionIdListener registered via web.xml which simply logs any calls made to its sessionIdChanged method.

      By inspecting the httpSessionIdListeners on the applicationListeners on the SessionListenerBridge, you can confirm that the listener has successfully been registered.

      Trigger a sessionId change by logging into the application.  You can confirm from the undertow logging that a session id does get changed:

      DEBUG [io.undertow.session] (default task-2) Changing session id 17bHjRwMP_dYGAL0DEssijYYw3cb6qKBlLf3AKk1 to 28BBAuRjAGR2Tncxa3uTpYiJzF1o-uGz0lvQow_9

      However, see from the lack of logging that listener's sessionIdChanged method never gets called.

       

      Show
      Deploy an application in WildFly (I'm using version 26.1.1), with an HttpSessionIdListener registered via web.xml which simply logs any calls made to its sessionIdChanged method. By inspecting the httpSessionIdListeners on the applicationListeners on the SessionListenerBridge, you can confirm that the listener has successfully been registered. Trigger a sessionId change by logging into the application.  You can confirm from the undertow logging that a session id does get changed: DEBUG [io.undertow.session] (default task-2) Changing session id 17bHjRwMP_dYGAL0DEssijYYw3cb6qKBlLf3AKk1 to 28BBAuRjAGR2Tncxa3uTpYiJzF1o-uGz0lvQow_9 However, see from the lack of logging that listener's sessionIdChanged method never gets called.  

    Description

      The implementation of sessionIdChanged in SessionListenerBridge is empty:

          @Override
    public void sessionIdChanged(Session session, String oldSessionId) {
    }

      Compare that for example to the implementation of sessionCreated:

          @Override
    public void sessionCreated(final Session session, final HttpServerExchange exchange) {
        final HttpSessionImpl httpSession = SecurityActions.forSession(session, servletContext, true);
        applicationListeners.sessionCreated(httpSession);
    }

      I suspect that the empty sessionIdChanged method is supposed to be calling applicationListeners.httpSessionIdChanged.

      As it stands, when I register a HttpSessionIdListener, its sessionIdChanged never gets called.

      Attachments

        Activity

          People

            rhn-cservice-bbaranow Bartosz Baranowski
            paulthomson Paul Thomson (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: