How to allow a session of a primary session to hold a session with a secondary session?

Refresh the question description to be more detailed and detailed.

I have weblogic 12c configured with one cluster, 4 node instances per cluster, Round Robin default upload algorithm , MAN replication type . I am deploying one web application on all 4 nodes.

What I create for the first time:

Perform logical business logic after a user session has expired. Put the logic code inside the sessionDestroyed SessionListener.java method, which implements the HttpSession interface. As you know, the session is invalid, it can be caused by 2 cases, one manually, the other a J2ee container that starts the timeout. My problem arises from the second case.

Question:

The business logic code inside the SessionDestroyed event is executed twice in a single user timeout, which is not expected and leads to a business error. What I found is the primary Http session on the node A session and the backup on node B, which fires the weblogic SessionDestroyed event.

Question:

  • - node B node A ?
  • Backup Session , ?

, , , - , .

DEBUG Oct-20-17 01:53:40 [[ACTIVE] ExecuteThread: '9' for queue: 'weblogic.kernel.Default (self-tuning)'] (AMCSessionListener-27  ) - Session: wIc4WB62vlaYR_tMRMIc0WpBHchh5fbwpinxgaig4mJRJFhlPUcj!-1795465203!1400921280!1508478820022 Created at Fri Oct 20 01:53:40 EDT 2017
DEBUG Oct-20-17 02:54:05 [[ACTIVE] ExecuteThread: '9' for queue: 'weblogic.kernel.Default (self-tuning)'] (AMCSessionListener-46  ) - Session: wIc4WB62vlaYR_tMRMIc0WpBHchh5fbwpinxgaig4mJRJFhlPUcj!-1795465203!1400921280!1508478820022 Destroyed at Fri Oct 20 02:54:05 EDT 2017
DEBUG Oct-20-17 02:55:12 [[ACTIVE] ExecuteThread: '17' for queue: 'weblogic.kernel.Default (self-tuning)'] (AMCSessionListener-46  ) - Session: wIc4WB62vlaYR_tMRMIc0WpBHchh5fbwpinxgaig4mJRJFhlPUcj!173379423!1400921280!1508478820022 Destroyed at Fri Oct 20 02:55:12 EDT 2017

​​ -:

<?xml version="1.0" encoding="UTF-8"?>
<weblogic-web-app
xmlns="http://www.bea.com/ns/weblogic/90"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.bea.com/ns/weblogic/90 http://www.bea.com/ns/weblogic/90/weblogic-web-app.xsd">
  <session-descriptor>
    <cookie-path>/AppName</cookie-path>
    <persistent-store-type>replicated</persistent-store-type>
    <http-proxy-caching-of-cookies>true</http-proxy-caching-of-cookies>
    <cookie-secure>true</cookie-secure>   
  </session-descriptor>  
</weblogic-web-app>

web.xml -:

<session-config>
    <session-timeout>60</session-timeout>
</session-config>

SessionListener.java:

public class SessionListener implements HttpSessionListener {

    private static Logger logger = Logger.getLogger(SessionListener.class);

    @Override
    public void sessionCreated(HttpSessionEvent se) {
        if (logger.isDebugEnabled()) {
            logger.debug("Session: " + se.getSession().getId() + " Created at " + (new java.util.Date()));
        }
    }

    @Override
    public void sessionDestroyed(HttpSessionEvent se) {
        /**
         * The business logic code related to logout action
         * would be executed twice here, this is not what I want.
         **/
        if (logger.isDebugEnabled()) {
            logger.debug("Session: " + se.getSession().getId() + " Destroyed at " + (new java.util.Date()));
        }
    }
}

:

@RequestMapping(value = "/logout", method = RequestMethod.GET)
public ModelAndView logout(HttpServletRequest request,
            HttpServletResponse response) throws Exception {

        ...
        // Business Logic for Logout
        ...

        request.getSession().invalidate();

        CommonViewObject vo = new CommonViewObject();
        return renderReponse(request, response, vo, "Login");
}

. , !

+4
3

invalidate(), HttpSessionListener sessionDestroyed() , .

, - . , ( , / -) sessionDestroyed ( ) - .

, - .

:

JDev/ADF: / /

JSP Servlet session invalidate()

+1
Session: wIc4WB62vlaYR_tMRMIc0WpBHchh5fbwpinxgaig4mJRJFhlPUcj!-1795465203!1400921280!1508478820022
Session: wIc4WB62vlaYR_tMRMIc0WpBHchh5fbwpinxgaig4mJRJFhlPUcj!-1795465203!1400921280!1508478820022
Session: wIc4WB62vlaYR_tMRMIc0WpBHchh5fbwpinxgaig4mJRJFhlPUcj!**173379423**!1400921280!1508478820022

, , jvm/ node (173379423), ( -795465203).

session.invalidate, ( node)

  • LB . fwd-ed node, 60
  • jvm (node a) , node (node c). LB, , (node a ) - jvm (node a)

UPDATE:

  • ? 2. , - ?
  There is no second session being created!!.

.

  • LB (F5) .
  • LB node Round Robin Basis. node A
  • Node A ( node B) sessionid cookie .

  • LB, LB cookie , node A

  • Node / Lb node A, LB Cookie, LB node Round Robin node (node D). node D Cookie, , node B .

    • **, - HttpClusterServlet (, - Apache) ( Weblogic (HttpClusterServlet)), -, HttpClusterServlet ( ) . node B , node B.

, .

**, ( LB/) , node A, , . , , , .

Weblogic .

/, , node. , LB

, LB Cookie.

0

, spring, CSRF,

http.csrf().disable()
0

Source: https://habr.com/ru/post/1687860/


All Articles