Details
-
Bug
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
6.8.0, 6.12.0
-
None
-
None
Description
Motivation:
Healthcheck/heartbeat pages must always be stateless to prevent significant amounts of session creation and storage.
Also each anonymously accessed page in a public site should be stateless due to the same reason (otherwise the site could easily be DoSsed down).
It would be nice to verify these requirements by tests.
If I create an ought-to-be-stateless page with an AjaxLink which is hidden by a behavior:
public class MyPage extends WebPage {
public MyPage() {
add(new AjaxLink<Void>("link") {
@Override
public void onClick(AjaxRequestTarget target)
}.add(new Behavior() {
@Override
public void onConfigure(Component c)
}));
add(new Label("isPageStateless", new AbstractReadOnlyModel<Boolean>() {
@Override
public Boolean getObject()
}));
}
}
then checking through a web server the page correctly prints "true", and no HttpSessions are created.
However, when I try to verify statelessness through WicketTester, the following test passes:
@Test
public void testName() throws Exception {
WicketTester tester = new WicketTester(new WebApplication() {
@Override
public Class<? extends Page> getHomePage()
});
tester.startPage(MyPage.class);
tester.assertLabel("isPageStateless", "false");
assertFalse(tester.getLastRenderedPage().isPageStateless());
}
It seems that somehow due to WicketTester, isPageStateless() is being invoked before any behaviors are run (and thus the AjaxLink is still visible), and since stateless-flag for the page is cached, it remains false.
If it's by design that isPageStateless should always return the same result during each request, then I guess that the statelessness resolution process must not depend on anything happening after the page constructor? I assume it's not by design.
Suggestions:
A) Obvious fix would be to remove stateless-flag caching, since apparently it is causing problems, as also suggested by a hackish comment in Page.init(). In general, caching should always be used sparingly.
B) Or maybe whoever is invoking isPageStateless() at an early stage should actually be using Page.peekPageStateless()? But this doesn't really seem like a real fix, more like a temporary hack.
C) All caching could also be disabled during test runs, but this would not be a good thing since tests should reproduce the actual behavior as closely as possible.
D) In case this is a known issue without a proper fix, how then could I verify page statelessness through WicketTester? Currently I'm clearing the stateless-cache by reflection, which feels kind of bad...
Attachments
Attachments
Issue Links
- is related to
-
-
- Resolved
-