Eclipse
/
jetty.project
mirror of https://github.com/jetty/jetty.project.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Issue #411 ensure MongoSessionManager saves maxInactiveInterval and expiry correctly 

Issue #415 ensure setting > MAX_INT session-timeout is detected
This commit is contained in:
Jan Bartel 2016-03-11 10:47:34 +11:00
parent 14c985802e
commit 8a24798fa4
5 changed files with 269 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
jetty-nosql/src/main/java/org/eclipse/jetty/nosql/mongodb/MongoSessionDataStore.java
View File

@ -423,11 +423,15 @@ public class MongoSessionDataStore extends NoSqlSessionDataStore
DBObject o = _dbSessions.findOne(new BasicDBObject("id", id), fields);
if (o != null)
{
Long currentMaxIdle = (Long)o.get(__MAX_IDLE);
Long currentExpiry = (Long)o.get(__EXPIRY);
if (currentMaxIdle != null && nsqd.getMaxInactiveMs() > 0 && nsqd.getMaxInactiveMs() < currentMaxIdle)
Long tmpLong = (Long)o.get(__MAX_IDLE);
long currentMaxIdle = (tmpLong == null? 0:tmpLong.longValue());
tmpLong = (Long)o.get(__EXPIRY);
long currentExpiry = (tmpLong == null? 0 : tmpLong.longValue());
if (currentMaxIdle != nsqd.getMaxInactiveMs())
sets.put(__MAX_IDLE, nsqd.getMaxInactiveMs());
if (currentExpiry != null && nsqd.getExpiry() > 0 && nsqd.getExpiry() != currentExpiry)
if (currentExpiry != nsqd.getExpiry())
sets.put(__EXPIRY, nsqd.getExpiry());
}
else

4
jetty-server/src/main/java/org/eclipse/jetty/server/session/Session.java
View File

@ -404,8 +404,10 @@ public class Session implements SessionManager.SessionIf
try (Lock lock = _lock.lockIfNotHeld())
{
_sessionData.setMaxInactiveMs((long)secs*1000L);
_sessionData.setExpiry(_sessionData.getMaxInactiveMs() <= 0 ? 0 : (System.currentTimeMillis() + _sessionData.getMaxInactiveMs()*1000L));
_sessionData.setExpiry(_sessionData.getMaxInactiveMs() <= 0 ? 0 : (System.currentTimeMillis() + _sessionData.getMaxInactiveMs()));
_sessionData.setDirty(true);
if (secs <= 0)
LOG.warn("Session {} is now immortal (maxInactiveInterval={})", _sessionData.getId(), secs);
}
}

10
jetty-server/src/main/java/org/eclipse/jetty/server/session/SessionManager.java
View File

@ -76,6 +76,13 @@ public class SessionManager extends ContainerLifeCycle implements org.eclipse.je
/* ------------------------------------------------------------ */
public final static int __distantFuture=60*60*24*7*52*20;
/**
* Web.xml session-timeout is set in minutes, but is stored as an int in seconds by HttpSession and
* the sessionmanager. Thus MAX_INT is the max number of seconds that can be set, and MAX_INT/60 is the
* max number of minutes that you can set.
*/
public final static java.math.BigDecimal MAX_INACTIVE_MINUTES = new java.math.BigDecimal(Integer.MAX_VALUE/60);
static final HttpSessionContext __nullSessionContext=new HttpSessionContext()
{
@Override
@ -656,6 +663,9 @@ public class SessionManager extends ContainerLifeCycle implements org.eclipse.je
public void setMaxInactiveInterval(int seconds)
{
_dftMaxIdleSecs=seconds;
if (_dftMaxIdleSecs < 0)
LOG.warn("Sessions created by this manager are immortal (default maxInactiveInterval={})"+_dftMaxIdleSecs);
}
/* ------------------------------------------------------------ */

9
jetty-webapp/src/main/java/org/eclipse/jetty/webapp/StandardDescriptorProcessor.java
View File

@ -649,9 +649,12 @@ public class StandardDescriptorProcessor extends IterativeDescriptorProcessor
{
XmlParser.Node tNode = node.get("session-timeout");
if (tNode != null)
{
int timeout = Integer.parseInt(tNode.toString(false, true));
context.getSessionHandler().getSessionManager().setMaxInactiveInterval(timeout * 60);
{
java.math.BigDecimal asDecimal = new java.math.BigDecimal(tNode.toString(false, true));
if (asDecimal.compareTo(org.eclipse.jetty.server.session.SessionManager.MAX_INACTIVE_MINUTES) > 0)
throw new IllegalStateException ("Max session-timeout in minutes is "+org.eclipse.jetty.server.session.SessionManager.MAX_INACTIVE_MINUTES);
context.getSessionHandler().getSessionManager().setMaxInactiveInterval(asDecimal.intValueExact() * 60);
}
//Servlet Spec 3.0

242
tests/test-sessions/test-mongodb-sessions/src/test/java/org/eclipse/jetty/nosql/mongodb/SessionExpiryTest.java
View File

@ -18,12 +18,39 @@
package org.eclipse.jetty.nosql.mongodb;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.eclipse.jetty.client.HttpClient;
import org.eclipse.jetty.client.api.ContentResponse;
import org.eclipse.jetty.client.api.Request;
import org.eclipse.jetty.server.session.AbstractSessionExpiryTest;
import org.eclipse.jetty.server.session.AbstractTestServer;
import org.eclipse.jetty.servlet.ServletContextHandler;
import org.eclipse.jetty.servlet.ServletHolder;
import org.eclipse.jetty.util.StringUtil;
import org.junit.AfterClass;
import org.junit.BeforeClass;
import org.junit.Test;
import com.mongodb.BasicDBObject;
import com.mongodb.DBCollection;
import com.mongodb.DBObject;
import static org.junit.Assert.assertTrue;
import java.io.IOException;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
public class SessionExpiryTest extends AbstractSessionExpiryTest
{
@ -58,4 +85,219 @@ public class SessionExpiryTest extends AbstractSessionExpiryTest
{
super.testSessionExpiry();
}
@Test
public void testBigSessionExpiry() throws Exception
{
String contextPath = "";
String servletMapping = "/server";
int inactivePeriod = Integer.MAX_VALUE * 60; //integer overflow
int scavengePeriod = 10;
int inspectPeriod = 1;
int idlePassivatePeriod = 0;
AbstractTestServer server1 = createServer(0, inactivePeriod, scavengePeriod, inspectPeriod, idlePassivatePeriod);
ChangeTimeoutServlet servlet = new ChangeTimeoutServlet();
ServletHolder holder = new ServletHolder(servlet);
ServletContextHandler context = server1.addContext(contextPath);
context.addServlet(holder, servletMapping);
TestHttpSessionListener listener = new TestHttpSessionListener();
context.getSessionHandler().addEventListener(listener);
server1.start();
int port1 = server1.getPort();
try
{
HttpClient client = new HttpClient();
client.start();
String url = "http://localhost:" + port1 + contextPath + servletMapping;
//make a request to set up a session on the server
ContentResponse response1 = client.GET(url + "?action=init");
assertEquals(HttpServletResponse.SC_OK,response1.getStatus());
String sessionCookie = response1.getHeaders().get("Set-Cookie");
assertTrue(sessionCookie != null);
// Mangle the cookie, replacing Path with $Path, etc.
sessionCookie = sessionCookie.replaceFirst("(\\W)(P|p)ath=", "$1\\$Path=");
String sessionId = AbstractTestServer.extractSessionId(sessionCookie);
DBCollection sessions = ((MongoSessionIdManager)((MongoTestServer)server1).getServer().getSessionIdManager()).getSessions();
verifySessionCreated(listener,sessionId);
//verify that the session timeout is set in mongo
verifySessionTimeout(sessions, sessionId, -1); //SessionManager sets -1 if maxInactive < 0
//get the session expiry time from mongo
long expiry = getSessionExpiry(sessions, sessionId);
assertEquals(0, expiry);
}
finally
{
server1.stop();
}
}
@Test
public void changeSessionTimeout() throws Exception
{
String contextPath = "";
String servletMapping = "/server";
int inactivePeriod = 10;
int scavengePeriod = 1;
int inspectPeriod = 1;
int idlePassivatePeriod = 0;
AbstractTestServer server1 = createServer(0, inactivePeriod, scavengePeriod, inspectPeriod, idlePassivatePeriod);
ChangeTimeoutServlet servlet = new ChangeTimeoutServlet();
ServletHolder holder = new ServletHolder(servlet);
ServletContextHandler context = server1.addContext(contextPath);
context.addServlet(holder, servletMapping);
TestHttpSessionListener listener = new TestHttpSessionListener();
context.getSessionHandler().addEventListener(listener);
server1.start();
int port1 = server1.getPort();
try
{
HttpClient client = new HttpClient();
client.start();
String url = "http://localhost:" + port1 + contextPath + servletMapping;
//make a request to set up a session on the server
ContentResponse response1 = client.GET(url + "?action=init");
assertEquals(HttpServletResponse.SC_OK,response1.getStatus());
String sessionCookie = response1.getHeaders().get("Set-Cookie");
assertTrue(sessionCookie != null);
// Mangle the cookie, replacing Path with $Path, etc.
sessionCookie = sessionCookie.replaceFirst("(\\W)(P|p)ath=", "$1\\$Path=");
String sessionId = AbstractTestServer.extractSessionId(sessionCookie);
DBCollection sessions = ((MongoSessionIdManager)((MongoTestServer)server1).getServer().getSessionIdManager()).getSessions();
verifySessionCreated(listener,sessionId);
//verify that the session timeout is set in mongo
verifySessionTimeout(sessions, sessionId, inactivePeriod);
//get the session expiry time from mongo
long expiry = getSessionExpiry(sessions, sessionId);
//make another request to change the session timeout to a smaller value
inactivePeriod = 5;
Request request = client.newRequest(url + "?action=change&val="+inactivePeriod);
request.getHeaders().add("Cookie", sessionCookie);
ContentResponse response2 = request.send();
assertEquals(HttpServletResponse.SC_OK,response2.getStatus());
//check the timeout in mongo
verifySessionTimeout(sessions, sessionId, inactivePeriod);
//check the session expiry time has decreased from previous value
assertTrue(getSessionExpiry(sessions, sessionId)<expiry);
expiry = getSessionExpiry(sessions, sessionId);
//increase the session timeout
inactivePeriod = 20;
request = client.newRequest(url + "?action=change&val="+inactivePeriod);
request.getHeaders().add("Cookie", sessionCookie);
response2 = request.send();
assertEquals(HttpServletResponse.SC_OK,response2.getStatus());
//verify that the session timeout is set in mongo
verifySessionTimeout(sessions, sessionId, inactivePeriod);
assertTrue(getSessionAccessed(sessions, sessionId)+ (1000L*inactivePeriod) == getSessionExpiry(sessions, sessionId));
}
finally
{
server1.stop();
}
}
public void verifySessionTimeout (DBCollection sessions, String id, int sec) throws Exception
{
long val;
if (sec > 0)
val = sec*1000L;
else
val = sec;
assertNotNull(sessions);
assertNotNull(id);
DBObject o = sessions.findOne(new BasicDBObject(MongoSessionDataStore.__ID,id));
assertNotNull(o);
Long maxIdle = (Long)o.get(MongoSessionDataStore.__MAX_IDLE);
assertNotNull(maxIdle);
assertEquals(val, maxIdle.longValue());
}
public long getSessionExpiry (DBCollection sessions, String id) throws Exception
{
assertNotNull(sessions);
assertNotNull(id);
DBObject o = sessions.findOne(new BasicDBObject(MongoSessionDataStore.__ID,id));
assertNotNull(o);
Long expiry = (Long)o.get(MongoSessionDataStore.__EXPIRY);
return (expiry == null? null : expiry.longValue());
}
public long getSessionMaxInactiveInterval (DBCollection sessions, String id) throws Exception
{
assertNotNull(sessions);
assertNotNull(id);
DBObject o = sessions.findOne(new BasicDBObject(MongoSessionDataStore.__ID,id));
assertNotNull(o);
Long inactiveInterval = (Long)o.get(MongoSessionDataStore.__MAX_IDLE);
return (inactiveInterval == null? null : inactiveInterval.longValue());
}
public long getSessionAccessed (DBCollection sessions, String id) throws Exception
{
assertNotNull(sessions);
assertNotNull(id);
DBObject o = sessions.findOne(new BasicDBObject(MongoSessionDataStore.__ID,id));
assertNotNull(o);
Long accessed = (Long)o.get(MongoSessionDataStore.__ACCESSED);
return (accessed == null? null : accessed.longValue());
}
public void debugPrint (DBCollection sessions, String id) throws Exception
{
assertNotNull(sessions);
assertNotNull(id);
DBObject o = sessions.findOne(new BasicDBObject(MongoSessionDataStore.__ID,id));
assertNotNull(o);
System.err.println(o);
}
public static class ChangeTimeoutServlet extends HttpServlet
{
@Override
protected void doGet(HttpServletRequest request, HttpServletResponse httpServletResponse) throws ServletException, IOException
{
String action = request.getParameter("action");
if ("init".equals(action))
{
HttpSession session = request.getSession(true);
session.setAttribute("test", "test");
}
else if ("change".equals(action))
{
String tmp = request.getParameter("val");
int val = (StringUtil.isBlank(tmp)?0:Integer.valueOf(tmp.trim()));
HttpSession session = request.getSession(false);
assertNotNull(session);
session.setMaxInactiveInterval(val);
}
}
}
}