tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Arvind Srinivasan <>
Subject [TC 4.0/4.1] - Recycling session objects is inherently error prone
Date Wed, 17 Jul 2002 08:13:24 GMT

Since the lifetime of session objects span requests and since session
objects are expired asynchronously by the background thread created by
the session manager, if one did recycle session objects then isn't it
possible for 2 separate requests to access and possibly modify a session
object simultaneously ?

 - Request 1 gets access to a session (session-timeout = 1 minute)
 - Request 1 then does some operations that take a couple of
 - The session manager thread expires the session and recycles
   the session object
 - Request 2 asks for a session and gets a reference to the recycled
   session object and starts using it
 - Request 1's database operations complete and it too uses the
o.a.c.session.ManagerBase has an ArrayList 'recycled' that is used for
recycling session objects. 4.0.x never uses this because manager is set
to null in StandardSession.recycle() and hence ManagerBase.recycle() is
never invoked. 4.1 however, does recycle sessions and does run into the
problem described in the above scenario when running a session based
load on a multi-cpu box.

If this is indeed a problem, I can submit a patch that removes the
session recycling code.


To unsubscribe, e-mail:   <>
For additional commands, e-mail: <>

View raw message