Multiple sessions are created when SessionRepositoryFilter precede ShallowEtagHeaderFilter

Multiple sessions are created when SessionRepositoryFilter precede ShallowEtagHeaderFilter. The reason being ShallowEtagHeaderFilter wraps the response with ShallowEtagResponseWrapper, which maintains an internal stream and commits the response just by copying the internal stream directly to the native httpresponse stream. Thus it bypass all HttpResponseWrappers in between including SessionRepositoryResponseWrapper, so the onResponseCommitted method is not getting called when the response is actually committed by ShallowEtagHeaderFilter.

When the control reaches SessionRepositoryFilter, response is already committed, so the newly added cookie header is not sent to the client. As a workaround, i moved SessionRepositoryFilter after ShallowEtagHeaderFilter in the filter chain and it works well.

Start by reproducing the filter-chain ordering described for SessionRepositoryFilter and ShallowEtagHeaderFilter, focusing on how ShallowEtagResponseWrapper copies its internal stream to the native response. Compare that path with SessionRepositoryResponseWrapper and its onResponseCommitted handling. Done means the session cookie is sent and only one session is created when the filters are ordered as described.