Http Session recreated after invalidate

[lRawd]

Spring Session 2.0.3.RELEASE
After calling invalidate() on an HttpSession in an HTTP request, if later in that same request you have an HttpSession autowired into a bean, a session scoped bean, or call request.getSession(false), the HttpSession is recreated,

After invalidate() is called the Session object is removed from the repository and the current session attribute is removed from the request wrapper.

spring-session/spring-session-core/src/main/java/org/springframework/session/web/http/SessionRepositoryFilter.java

Line 396 in a39295c

setCurrentSession(null);

However the request,getSession(false) call repopulates the current session attribute.

spring-session/spring-session-core/src/main/java/org/springframework/session/web/http/SessionRepositoryFilter.java

Line 307 in a39295c

setCurrentSession(currentSession);

When commitSession() is finally called current session is populated and it puts the session back into the repository.

spring-session/spring-session-core/src/main/java/org/springframework/session/web/http/SessionRepositoryFilter.java

Line 233 in a39295c

saveSession(session);

[lRawd]

The code in 2.1.1 is a bit different but it looks like it is still affected by this.

[vpavic]

Thanks for the report @lRawd.

It's not clear to me which exact sequence of events is required to reproduce this? Any chance you could put together a minimal sample app that would help us understand the problem better?

[lRawd]

I think its as simple as calling:

request.getSession(true).invalidate();
//...
request.getSession(false).getId();

I will double check and put a sample together.

[vpavic]

Thanks for following up - I've tried something along those lines but request.getSession(false) returned null for me.

[lRawd]

In 2.1.2.RELEASE request.getSession(false) returns null but in 2.0.3.RELEASE I am getting a session object back. Although, I am not seeing the same issues that I reported where the session resumed. I must have made a mistake somewhere in my code that caused the sessions to get recreated. If I find something as I continue development with the latest version then I will reopen this.

[vpavic]

Thanks for following up again @lRawd - just to be safe, could you give 2.0.7.RELEASE a spin? This is to ensure the latest release from 2.0.x line is OK. Thanks!

[vpavic]

@lRawd I've managed to reproduce this using 2.0.3.RELEASE - this is actually a duplicate of #1076 that was resolved in 2.0.4.RELEASE. So please upgrade to 2.0.4.RELEASE or preferably latest release from 2.0.x line (2.0.7.RELEASE that is).

[vpavic]

Duplicate of #1076