spring-projects / spring-projects/spring-session

Mismatched constant names for the HTTP session id in a websocket context

Open
#561 5 comments 9 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage
Dominant language
Java
Stars
1.9k
Forks
1.2k
Avg merge
4h 27m
Merged PRs (30d)
55

Description

Both SessionRepositoryMessageInterceptor from SpringSession and HttpSessionHandshakeInterceptor define constants for the HTTP session id.

Spring session defines the constant as SPRING.SESSION.ID and spring-websockets defines it as HTTP.SESSION.ID.

The constants are different and this leads to an null pointer exception when HttpSessionHandshakeInterceptor is enabled. The stacktrace is below.

[ERROR] 2016-06-27 11:52:59.679 [http-nio-8080-exec-8] WebSocketConnectHandlerDecoratorFactory:87 - Error publishing org.springframework.session.web.socket.events.SessionConnectEvent[source=SessionWebSocketHandler [delegate=SubProtocolWebSocketHandler[StompSubProtocolHandler[v10.stomp, v11.stomp, v12.stomp]]]].
java.lang.NullPointerException
    at java.util.concurrent.ConcurrentHashMap.get(ConcurrentHashMap.java:936) ~[?:1.8.0_91]
    at org.springframework.session.web.socket.handler.WebSocketRegistryListener.registerWsSession(WebSocketRegistryListener.java:118) ~[spring-session-1.2.0.RELEASE.jar:?]
    at org.springframework.session.web.socket.handler.WebSocketRegistryListener.afterConnectionEstablished(WebSocketRegistryListener.java:86) ~[spring-session-1.2.0.RELEASE.jar:?]
    at org.springframework.session.web.socket.handler.WebSocketRegistryListener.onApplicationEvent(WebSocketRegistryListener.java:67) ~[spring-session-1.2.0.RELEASE.jar:?]
    at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:166) ~[spring-context-4.3.0.RELEASE.jar:4.3.0.RELEASE]
    at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:138) ~[spring-context-4.3.0.RELEASE.jar:4.3.0.RELEASE]
    at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:382) ~[spring-context-4.3.0.RELEASE.jar:4.3.0.RELEASE]
    at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:336) ~[spring-context-4.3.0.RELEASE.jar:4.3.0.RELEASE]

The session id is present in the attributes map under the key HTTP.SESSION.ID. Spring session version 1.2.0.RELEASE. Spring websocket version is 4.3.0.RELEASE.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing the session-id constants in SessionRepositoryMessageInterceptor and HttpSessionHandshakeInterceptor, then trace how WebSocketRegistryListener reads the attributes map. Add a regression test for the handshake configuration using the HTTP.SESSION.ID attribute, and run the relevant Spring Session WebSocket tests; done means the shared session id is resolved without a null pointer exception.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.