Re: [jetty-users] Sessions are not invalidated at shutdown any longer

[Jan Bartel <janb@xxxxxxxxxxx>]

Dirk,

I think you're spot on here: I do remember changing my mind about whether a session data store could be null or not. I've raised an issue for that: https://github.com/eclipse/jetty.project/issues/4920

Cheers

Jan

On Thu, 28 May 2020, 12:36 Dirk Olmes, <dirk.olmes@xxxxxxxxxx> wrote:

On 5/28/20 11:08 AM, Jan Bartel wrote:
> Sounds like you need the NullSessionDataStore:
> https://github.com/eclipse/jetty.project/blob/jetty-9.4.x/jetty-server/src/main/java/org/eclipse/jetty/server/session/NullSessionDataStore.java

... whis is active by default, yes.

But then in DefaultSessionCache's shutdown method the _sessionDataStore
is not null and the else branch will not be executed, i.e. the sessions
will not be invalidated as they are "stored" by the NullSessionDataStore.

IMHO the code is inconsistent here: some parts of AbstractSessionCache
assume that there is a _sessionDataStore (e.g. doStop(), commit(Session)
etc.) and some parts are safely guarded with null checks.
DefaultSessionCache suggests that it's OK to have no _sessionDataStore ...

I imagine I could hack together a subclass of DefaultSessionCache, grab
the sessions and invalidate them manually but I think a proper fix in
the Jetty codebase would be better.

-dirk

_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users