[SHALE-461] TokenProcessor bypasses HttpSession.setAttribute()

• Type: Bug
• Status: Open
• Priority: Trivial
• Resolution: Unresolved
• Component/s: Core
• Assignee: Unassigned
• Reporter: Bernhard Huemer
• Created: 05/Aug/07 17:36
• Updated: 05/Aug/07 17:36

Description

The TokenProcessor (org.apache.shale.util.Tokenprocessor) saves the generated Token in a Set, which itself is saved in the session. The problem is that there is no additional call to setAttribute (i.e. no additional call to sessionMap.put) but that's a requirement for a server which wants to replicate only the deltas of a session. However, I was never confronted to this problem as I've never used Shale in a distributed environment. This report is just based on my understanding of session replication so please correct me if I'm wrong.

/// TokenProcessor.java, line 87

// Store the generated value for later verification
Set set = (Set)
context.getExternalContext().getSessionMap().get(ShaleConstants.TOKENS);
if (set == null) {
set = new HashSet();
context.getExternalContext().getSessionMap().put(ShaleConstants.TOKENS, set);
}
set.add(token);

\\\

The following modification should work.

///

// Store the generated value for later verification
Set set = (Set)
context.getExternalContext().getSessionMap().get(ShaleConstants.TOKENS);
if (set == null) {
set = new HashSet();
}
set.add(token);
context.getExternalContext().getSessionMap().put(ShaleConstants.TOKENS, set);

\\\