[OWB-1083] WebContextsService errors when servlet session invalidated during request lifecycle

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.6.0
• Fix Version/s: 1.6.1
• Component/s: Web
• Assignee: Mark Struberg
• Reporter: Adam Cornett
• Created: 12/Jun/15 03:25
• Updated: 29/Jul/15 07:46
• Resolved: 12/Jun/15 16:49

Description

If the session is invalidated during the processing of the request an
exception is thrown when OpenWebBeans is cleaning up.

The issue is in the WebContextsService.destroyRequestContext method, which
tries to get the session from the request, however it calls the no-arg
getSession(),
which will, per the spec, try to create a new session if one does not
exist. However since the response has been committed this is not allowed
to create a new session and an exception is thrown.
The solution is to call getSession(false),
which will return null if the session does not exist. This seems to be the
desired behavior anyway since the result of the call is null checked a few
lines later.

I have tested this change in our application and it produces the desired
behavior.

Current code:

            Object payload = null;
            if (context.getServletRequest() != null)
            {
                payload = context.getServletRequest().getSession();
            }

            webBeansContext.getBeanManagerImpl().fireContextLifecyleEvent(
                payload != null ? payload : new Object(), DestroyedLiteral.INSTANCE_SESSION_SCOPED);

Suggested fix:

            Object payload = null;
            if (context.getServletRequest() != null)
            {
                payload = context.getServletRequest().getSession(false);
            }

            webBeansContext.getBeanManagerImpl().fireContextLifecyleEvent(
                payload != null ? payload : new Object(), DestroyedLiteral.INSTANCE_SESSION_SCOPED);