On Session invalidate, wicket creates a new folder with session data in wicket-filter-store

classic Classic list List threaded Threaded
11 messages Options
Reply | Threaded
Open this post in threaded view
|

On Session invalidate, wicket creates a new folder with session data in wicket-filter-store

AliKhan
We are using AuthenticatedWebSession  of wicket version 7.0.0. When user logs
out (super.invalidate();) we have noticed that wicket deletes the
folder/files related to current session. However, at the same time, It is
creating a new folder and files on session invalidation.
This leads to create a hundred of thousands of files and folders as we have
a large number of users who are using the system.
Can someone direct me how to fix it?

--
Sent from: http://apache-wicket.1842946.n4.nabble.com/Users-forum-f1842947.html

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: On Session invalidate, wicket creates a new folder with session data in wicket-filter-store

Martin Grigorov-4
Hi,

Please update Wicket to a newer version! E.g. 7.12.0

If this doesn't help then put a breakpoint at
org.apache.wicket.Session#bind() method and see whether it is called after
the invalidation of the previous session.
It seems something leads to a new creation of an http session.

On Wed, Feb 20, 2019 at 12:15 PM AliKhan <[hidden email]> wrote:

> We are using AuthenticatedWebSession  of wicket version 7.0.0. When user
> logs
> out (super.invalidate();) we have noticed that wicket deletes the
> folder/files related to current session. However, at the same time, It is
> creating a new folder and files on session invalidation.
> This leads to create a hundred of thousands of files and folders as we have
> a large number of users who are using the system.
> Can someone direct me how to fix it?
>
> --
> Sent from:
> http://apache-wicket.1842946.n4.nabble.com/Users-forum-f1842947.html
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>
Reply | Threaded
Open this post in threaded view
|

Re: On Session invalidate, wicket creates a new folder with session data in wicket-filter-store

AliKhan
Thanks for your quick reply!
I have verified as you suggested to breakpoint at Session#bind(). This
method is called 2 times after the session is invalidated. Strange thing is
that when user login, bind() is called only 1 time but on session invalidate
it is being called 2 times.  
I did not bumped the wicket version yet though. I verified this with version
7.0.0.

--
Sent from: http://apache-wicket.1842946.n4.nabble.com/Users-forum-f1842947.html

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: On Session invalidate, wicket creates a new folder with session data in wicket-filter-store

Martin Grigorov-4
While the debugger is stopped at the breakpoint you can see what leads to
this call in the stacktrace.
If it is coming from the application code then you should fix it.
If it is triggered by Wicket itself then please upgrade to 7.12.0 and try
again. If it still does the same then please create a mini application that
reproduces the problem and attach it to a ticket at
https://issues.apache.org/jira/projects/WICKET/issues

On Wed, Feb 20, 2019 at 1:53 PM AliKhan <[hidden email]> wrote:

> Thanks for your quick reply!
> I have verified as you suggested to breakpoint at Session#bind(). This
> method is called 2 times after the session is invalidated. Strange thing is
> that when user login, bind() is called only 1 time but on session
> invalidate
> it is being called 2 times.
> I did not bumped the wicket version yet though. I verified this with
> version
> 7.0.0.
>
> --
> Sent from:
> http://apache-wicket.1842946.n4.nabble.com/Users-forum-f1842947.html
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>
kyc
Reply | Threaded
Open this post in threaded view
|

Re: On Session invalidate, wicket creates a new folder with session data in wicket-filter-store

kyc
As I encountered the same problem as AliKhan,  I follow Martin's suggestion
to upgrade the wicket version from 7.10 to 7.12.  However, I still go to the
following code inside the bind() method when the session is invalidate.

                        // explicitly create a session
                        id = store.getSessionId(request, true);
                        // bind it
                        store.bind(request, this);


Session.java
        public final void bind()
        {
                // If there is no request cycle then this is not a normal request but for
example a last
                // modified call.
                if (RequestCycle.get() == null)
                {
                        return;
                }

                ISessionStore store = getSessionStore();
                Request request = RequestCycle.get().getRequest();
                if (store.lookup(request) == null)
                {
                        // explicitly create a session
                        id = store.getSessionId(request, true);
                        // bind it
                        store.bind(request, this);

                        if (temporarySessionAttributes != null)
                        {
                                for (Map.Entry<String, Serializable> entry :
temporarySessionAttributes.entrySet())
                                {
                                        store.setAttribute(request, entry.getKey(), entry.getValue());
                                }
                                temporarySessionAttributes = null;
                        }
                }
        }

--
Sent from: http://apache-wicket.1842946.n4.nabble.com/Users-forum-f1842947.html

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: On Session invalidate, wicket creates a new folder with session data in wicket-filter-store

Martin Grigorov-4
Hi,

The question is what leads to the call of Session#bind().
While the debugger is at Session#bind() see what is the stacktrace from top
to bottom.
Maybe after logout you redirect to a stateful page and Wicket needs to
create a new Session to store that page ...

On Thu, Feb 21, 2019 at 10:21 AM kyc <[hidden email]> wrote:

> As I encountered the same problem as AliKhan,  I follow Martin's suggestion
> to upgrade the wicket version from 7.10 to 7.12.  However, I still go to
> the
> following code inside the bind() method when the session is invalidate.
>
>                         // explicitly create a session
>                         id = store.getSessionId(request, true);
>                         // bind it
>                         store.bind(request, this);
>
>
> Session.java
>         public final void bind()
>         {
>                 // If there is no request cycle then this is not a normal
> request but for
> example a last
>                 // modified call.
>                 if (RequestCycle.get() == null)
>                 {
>                         return;
>                 }
>
>                 ISessionStore store = getSessionStore();
>                 Request request = RequestCycle.get().getRequest();
>                 if (store.lookup(request) == null)
>                 {
>                         // explicitly create a session
>                         id = store.getSessionId(request, true);
>                         // bind it
>                         store.bind(request, this);
>
>                         if (temporarySessionAttributes != null)
>                         {
>                                 for (Map.Entry<String, Serializable> entry
> :
> temporarySessionAttributes.entrySet())
>                                 {
>                                         store.setAttribute(request,
> entry.getKey(), entry.getValue());
>                                 }
>                                 temporarySessionAttributes = null;
>                         }
>                 }
>         }
>
> --
> Sent from:
> http://apache-wicket.1842946.n4.nabble.com/Users-forum-f1842947.html
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>
kyc
Reply | Threaded
Open this post in threaded view
|

Re: On Session invalidate, wicket creates a new folder with session data in wicket-filter-store

kyc
After logout page, it will redirect to the login page.  I have already
converted the login and logout pages to Stateless page by adding
@StatelessComponent with the StatelessChecker to them (without exception in
runtime).  I don't know why the bind() is still being called and new session
is created after the invalidate()

AbcWebSession(Session).bind() line: 272
LoginPage(Page).onBeforeRender() line: 808
LoginPage(Component).internalBeforeRender() line: 950
LoginPage(Component).beforeRender() line: 1018
LoginPage(Component).internalPrepareForRender(boolean) line: 2236
LoginPage(Page).internalPrepareForRender(boolean) line: 242
LoginPage(Component).render() line: 2327
LoginPage(Page).renderPage() line: 1018
WebPageRenderer.renderPage(Url, RequestCycle) line: 124
WebPageRenderer.respond(RequestCycle) line: 236
RenderPageRequestHandler.respond(IRequestCycle) line: 175
RequestCycle$HandlerExecutor.respond(IRequestHandler) line: 895
RequestCycle$HandlerExecutor(RequestHandlerStack).execute(IRequestHandler)
line: 64
RequestCycle.execute(IRequestHandler) line: 265
RequestCycle.processRequest() line: 222
RequestCycle.processRequestAndDetach() line: 293
WicketFilter.processRequestCycle(RequestCycle, WebResponse,
HttpServletRequest, HttpServletResponse, FilterChain) line: 261
WicketFilter.processRequest(ServletRequest, ServletResponse, FilterChain)
line: 203
WicketFilter.doFilter(ServletRequest, ServletResponse, FilterChain) line:
284


--
Sent from: http://apache-wicket.1842946.n4.nabble.com/Users-forum-f1842947.html

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: On Session invalidate, wicket creates a new folder with session data in wicket-filter-store

Martin Grigorov-4
The stacktrace says: LoginPage(Page).onBeforeRender() line: 808
What is the code at lines 800-808 in your LoginPage class ?

On Thu, Feb 21, 2019 at 11:56 AM kyc <[hidden email]> wrote:

> After logout page, it will redirect to the login page.  I have already
> converted the login and logout pages to Stateless page by adding
> @StatelessComponent with the StatelessChecker to them (without exception in
> runtime).  I don't know why the bind() is still being called and new
> session
> is created after the invalidate()
>
> AbcWebSession(Session).bind() line: 272
> LoginPage(Page).onBeforeRender() line: 808
> LoginPage(Component).internalBeforeRender() line: 950
> LoginPage(Component).beforeRender() line: 1018
> LoginPage(Component).internalPrepareForRender(boolean) line: 2236
> LoginPage(Page).internalPrepareForRender(boolean) line: 242
> LoginPage(Component).render() line: 2327
> LoginPage(Page).renderPage() line: 1018
> WebPageRenderer.renderPage(Url, RequestCycle) line: 124
> WebPageRenderer.respond(RequestCycle) line: 236
> RenderPageRequestHandler.respond(IRequestCycle) line: 175
> RequestCycle$HandlerExecutor.respond(IRequestHandler) line: 895
> RequestCycle$HandlerExecutor(RequestHandlerStack).execute(IRequestHandler)
> line: 64
> RequestCycle.execute(IRequestHandler) line: 265
> RequestCycle.processRequest() line: 222
> RequestCycle.processRequestAndDetach() line: 293
> WicketFilter.processRequestCycle(RequestCycle, WebResponse,
> HttpServletRequest, HttpServletResponse, FilterChain) line: 261
> WicketFilter.processRequest(ServletRequest, ServletResponse, FilterChain)
> line: 203
> WicketFilter.doFilter(ServletRequest, ServletResponse, FilterChain) line:
> 284
>
>
> --
> Sent from:
> http://apache-wicket.1842946.n4.nabble.com/Users-forum-f1842947.html
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>
kyc
Reply | Threaded
Open this post in threaded view
|

Re: On Session invalidate, wicket creates a new folder with session data in wicket-filter-store

kyc
This post was updated on .
LoginPage(Page).onBeforeRender() line: 808
Does it mean the Page.class 808 ?

Page.class line 808 : getSession().bind();
        /**
         *
         * @see org.apache.wicket.Component#onBeforeRender()
         */
        @Override
        protected void onBeforeRender()
        {
                // Make sure it is really empty
                renderedComponents = null;

                // rendering might remove or add stateful components, so clear flag to
force reevaluation
                stateless = null;

                super.onBeforeRender();

                // If any of the components on page is not stateless, we need to bind the
session
                // before we start rendering components, as then jsessionid won't be
appended
                // for links rendered before first stateful component
                if (getSession().isTemporary() && !peekPageStateless())
                {
                        *getSession().bind();*
                }
        }

Additional information:
I check the peekPageStateless() and find the method called several times for the login page is loaded.
res is true (2 times), res is false (the remaining times)

         private boolean peekPageStateless()
        {
                Boolean old = stateless;
                Boolean res = isPageStateless();
                stateless = old;
                return res;
        }




--
Sent from: http://apache-wicket.1842946.n4.nabble.com/Users-forum-f1842947.html

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@wicket.apache.org
For additional commands, e-mail: users-help@wicket.apache.org

Reply | Threaded
Open this post in threaded view
|

Re: On Session invalidate, wicket creates a new folder with session data in wicket-filter-store

Martin Grigorov-4
In reply to this post by Martin Grigorov-4
On Fri, Feb 22, 2019 at 4:02 AM kyc <[hidden email]> wrote:

> I applied the SessionPerTabHttpSessionStore and SessionPerTabBehavior (by
> adding cookie to session storage) in our site (ref. to
> https://issues.apache.org/jira/browse/WICKET-6358
> https://github.com/martin-g/blogs/tree/master/session-per-tab
> which causes the stateless login page creates new session after loading
>

This project was an experiment that is not battle tested.
Looking at the code of these two classes I do not see anything that will
lead to binding of a new Session.
These classes have logic to store and read the Wicket session from a custom
attribute in the http session, but it doesn't force binding of a Session.
Something else should lead to this
Wicket Behavior is stateless by default:
https://github.com/apache/wicket/blob/3704144b73521c6b10de5fa7864773230762e86c/wicket-core/src/main/java/org/apache/wicket/behavior/Behavior.java#L153-L160
and  SessionPerTabBehavior shouldn't make the page stateful. But anyway
this behavior should be applied only to authenticated pages. There is no
point in using it for public/stateless pages.


> --
> Sent from:
> http://apache-wicket.1842946.n4.nabble.com/Users-forum-f1842947.html
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>
Reply | Threaded
Open this post in threaded view
|

Re: On Session invalidate, wicket creates a new folder with session data in wicket-filter-store

AliKhan
Thank you Martin for your help and guidance. It was our Login Page that was
using Form component instead of StatelessForm that was leading this session
data creation problem in our application.

What I have found that To make a page Stateless ( as the login pages should
be stateless) we have to check that we are not using any stateful component
within the Stateless page.

We are using CheckBoxMultipleChoice in the login page, when printed out the
state:

 @Override
  protected void onInitialize() {
    super.onInitialize();
    visitChildren(new IVisitor<Component, Void>() {
      @Override
      public void component(Component component, IVisit<Void> arg1) {
        if(!component.isStateless())
          logger.info("Component " + component.getId() + " is not
stateless");
      }
    });
  }
I learned that CheckBoxMultipleChoice is a statefull component . I tried to
find the stateless variant of this component but without any luck.  Can you
please guide me what choices I have to make this component a Stateless ?  
Many Thanks!

--
Sent from: http://apache-wicket.1842946.n4.nabble.com/Users-forum-f1842947.html

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]