HttpServletRequest.getSession with Primefaces 12.0.x

[MacNord]

Hello

With Primefaces 12.0.x I observed a change of how calls to javax.servlet.http.HttpServletRequest.getSession behave compared to previous versions.

Primefaces 11.0.x / 10.0.x:
1st request after server start
-> servletRequest.getSession(true) => a new session is created with a new session id
2nd request from same browser window, navigating to another page with Primefaces components
-> servletRequest.getSession(false) => the same session is returned, same id (httpSession.getId())

Primefaces 12.0.x:
1st request after server start
-> servletRequest.getSession(true) => a new session is created with a new session id (same as with 11.0.x / 10.0.x)
2nd. request from same browser window, navigating to another page with Primefaces components
-> servletRequest.getSession(false) => also a NEW session is created with a new session id although it should return null or the session from first request according to JavaDoc and like in previous versions.

This can be observed only one time after a server start (wildfly-26.1.0.Final, myfaces-2.3.10). To reproduce a server restart is needed.
I see no exceptions in the server log nor in the browser console log.
I don't understand how HTTP session creation is related to Primefaces but changing version from 12.0.5 to 11.0.10 reliably solves the issue.
Any hints / insights ?

Thanks you.

Martin

PS: Problem occurs only with Chrome Version 113.0.5672.63 (Official Build) (64-bit)... not with Firefox 113.0.1 (64-bit)

[Melloware]

Hmmm you are right that makes no sense as PF doesn't really do anything with Session.


The only place I even see getSession called in the whole code base is in FileUploadFilter?

Code: Select all

protected FileItemFactory createFileItemFactory(HttpServletRequest httpServletRequest) {
        DiskFileItemFactory diskFileItemFactory = new DiskFileItemFactory();
        if (thresholdSize != null) {
            diskFileItemFactory.setSizeThreshold(Integer.parseInt(thresholdSize));
        }
        if (uploadDir != null) {
            diskFileItemFactory.setRepository(new File(uploadDir));
        }

        FileCleaningTracker fileCleaningTracker = FileCleanerCleanup.getFileCleaningTracker(httpServletRequest.getSession().getServletContext());
        if (fileCleaningTracker != null) {
            diskFileItemFactory.setFileCleaningTracker(fileCleaningTracker);
        }

        return diskFileItemFactory;
    }

[wuckertrhea]

You are correct, though, that doesn't make sense because PF doesn't really interact with Sessions.


In the entire code base, where do I even see the call to getSession made but in FileUploadFilter?


monkey mart

[Melloware]

Right here: https://github.com/primefaces/primeface ... .java#L135