Details
-
Bug
-
Resolution: Cannot Reproduce
-
Low
-
None
-
4.0
-
4
-
Severity 3 - Minor
-
0
-
Description
Site Mesh creates a Tomcat session even when it does nothing. Check PageFilter.doFilter:
// force creation of the session now because Tomcat 4 had problems with // creating sessions after the response had been committed if (Container.get() == Container.TOMCAT) { request.getSession(true); }
This is fine for the web application, because we always have a session. When doing REST (/rest/) and Plugins (/plugins/servlet/) we don't always have session (especially in relation to REST where calls may come from non-web browser clients). This creates a new session per request that is left around to timeout. This had bad effects when using the dashboard plugin (JRA-18664).
We no longer use sitemesh for REST. We left it on the servlet plugins because we actually have a use case (the OAUTH GUI).
We need to find a way to get sitemesh not to create sessions when the page is not going to be decorated. Couple of ideas:
- Change sitemesh not to have this session code, provided that it works.
- Only sitemesh a special part of the REST API URL namespace (e.g. /rest/ui/*).
Good night and goodluck.
Attachments
Issue Links
- is related to
-
JRASERVER-16503 Use HTMLPageParser in Sitemesh instead of the deprecated FastPageParser.
- Closed
- relates to
-
JRASERVER-18664 Viewing a dashboard creates around 100 HttpSession objects.
- Closed