[WICKET-5164] PageStoreManager.SessionEntry keeps outdated sessionId when container changes sessionId

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 6.7.0, 7.0.0-M1
• Fix Version/s: 6.10.0, 7.0.0-M1
• Component/s: wicket
• Assignee: Sven Meier
• Reporter: Sven Meier
• Created: 30/Apr/13 07:25
• Updated: 28/Aug/14 11:16
• Resolved: 11/Jul/13 12:11

Description

PageStoreManager keeps the initial sessionId for each SessionEntry.
If the container changes the sessionId later (e.g. Tomcat's "Session Fixation Protection"), all pages continue to be stored under the the initial sessionId. This is necessary to be able to access old pages even after a change to the sessionId.

However PageStoreManager#sessionExpired(String) passes the current sessionId to the PageStore. If it is not longer equal the original sessionId, the PageStore will fail to remove the stored pages for the session.

Issue Links

• breaks: WICKET-5688 Restore the functionality an IPageManager to be able to clean all data/pages for the current session
• relates to: WICKET-5103 Wicket session id not up to date when container changes session id