0003715: Session id reuse

Viewing Issue Advanced Details [ Jump to Notes ]

[ View Simple ] [ Issue History ] [ Print ]

Category

Severity

Reproducibility

Date Submitted

Last Update

0003715

[Resin]

minor

always

10-16-09 09:39

02-26-10 14:45

Reporter

emil

View Status

public

Assigned To

alex

Priority

normal

Resolution

fixed

Platform

Status

closed

Projection

none

OS Version

ETA

none

Fixed in Version

3.1.11

Product Version

3.1.9

Product Build

Summary

0003715: Session id reuse

Description

(rep by SHINOMIYA Nobuaki)

When I repeated that the session is create, session ID is recycled.

Environment:
  *The Cluster Sessions(memory-to-memory) is enabled .

    <resin:if test="${resin.professional}">
      <persistent-store type="cluster">
        <init path="work/httpd/session"/>
      </persistent-store>
    </resin:if>

    ........

    <session-config>
      <use-persistent-store>true</use-persistent-store>
      <always-save-session>true</always-save-session>
      <save-mode>after-request</save-mode>
      <reuse-session-id>false</reuse-session-id>
    </session-config>

  *Session ID exists in Cookie of a browser.

  *Resin 3.1.9

  *WinXP

In the access since the second times, This is always occur.

We create the servlet(attchement) that repeats the creation of the session for
+check.

Remark:
  * We don't check when The Cluster Sessions(DB)
  * It dosen't occur when <always-save-session> is false
  * It dosen't occur when the Session ID dosen't exist in Cookie of a browser.

attchement's files
  * The servlet to check : SessionServlet.java
  * The result of check : result.html

Steps To Reproduce

Additional Information

Verified in Resin 3.1.9
Fixed in Resin 4.0.1

Reporter would like fix in 3.1 branch

Attached Files

SessionServlet.java [^] (2,382 bytes) 10-16-09 09:39

Relationships

Notes
(0004443) ferg 02-18-10 13:53	server/01ni

(0004448) alex 02-26-10 14:27	server/01in.qa vs server/01ni.qa

Issue History
Date Modified	Username	Field	Change
10-16-09 09:39	emil	New Issue
10-16-09 09:39	emil	File Added: SessionServlet.java
02-18-10 13:53	ferg	Note Added: 0004443
02-18-10 13:53	ferg	Assigned To	=> ferg
02-18-10 13:53	ferg	Status	new => closed
02-18-10 13:53	ferg	Resolution	open => fixed
02-18-10 13:53	ferg	Fixed in Version	=> 3.1.10
02-26-10 14:27	alex	Assigned To	ferg => alex
02-26-10 14:27	alex	Status	closed => feedback
02-26-10 14:27	alex	Resolution	fixed => reopened
02-26-10 14:27	alex	Note Added: 0004448
02-26-10 14:45	alex	Status	feedback => closed
02-26-10 14:45	alex	Resolution	reopened => fixed
02-26-10 14:45	alex	Fixed in Version	3.1.10 => 3.1.11

Mantis 1.0.0rc3[^]

33 total queries executed.
28 unique queries executed.