[WW-3895] Synchronization on HttpSession object

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.3.4.1
• Fix Version/s: 2.3.20
• Assignee: Lukasz Lenart
• Reporter: Patrick Cavanaugh
• Created: 11/Oct/12 21:00
• Updated: 13/Jan/15 11:58
• Resolved: 22/Aug/14 15:26

Description

I noticed that in the fix for WW-3865 (and in current 2.3.4.1 code), synchronization is made based on the HttpSession object.

According to http://yet-another-dev.blogspot.com/2009/08/synchronizing-httpsession.html and http://stackoverflow.com/a/616723/631628 , HttpSession isn't guaranteed by the specification to be the same object each time getSession() is called and so the synchronization might not work correctly. That post suggests synchronizing on the interned session ID instead. There are might be other places in the codebase this would have to be changed too, and not just in the TokenSessionInterceptor discussed in WW-3865.

Issue Links

• relates to: WW-3865 TokenSesion double submit sends a blank page to ie and stacktrace on server