[GEODE-9468] tomcat session state management will not work on java 16

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Problem
• Component/s: http session
• Labels: Java16
• Assignee: Unassigned
• Reporter: Darrel Schneider
• Created: 27/Jul/21 21:33
• Updated: 19/Apr/22 23:27
• Resolved: 19/Apr/22 23:27

Description

The class org.apache.geode.modules.session.catalina.DeltaSession calls Field.setAccessible in a static block. It is getting access to a field in the super class which was private in tomcat 7 (see GEODE-3434). Because of this tomcat session state management will not work on java 16 (see https://softwaregarden.dev/en/posts/new-java/illegal-access-in-java-16/) unless jvm args are used to permit the call (for example "--illegal-access=permit").

If we can drop support for tomcat 7 then this reflection would no longer be needed. It might also be possible to only call setAccessible if the field is private which would mean only tomcat 7 would not work on java 16.