vaadin / vaadin/framework

Vaadin 8.8.0 and Jetty 9.4 incompatibility

Open
#11,587 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Java
Stars
1.8k
Forks
717
Avg merge
2d 6h
Merged PRs (30d)
3

Description

Vaadin Framework version : 8.8.0
embedded Jetty Version: 9.4.18.v20190429
I also set up: (manually enforce use of Jetty93AsyncSupportWithWebSocket)

ApplicationConfig.PROPERTY_SESSION_SUPPORT = true
ApplicationConfig.PROPERTY_ALLOW_SESSION_TIMEOUT_REMOVAL =true
ApplicationConfig.PROPERTY_COMET_SUPPORT,
= org.atmosphere.container.Jetty93AsyncSupportWithWebSocket"

  • Actual behavior
    Right after loading a page, with WebSocket switched up, Vaadin server responds with Session Expired. No delays, the first push with the protocol upgrade to websocket immediatly has the Session Timout error message.

  • Expected behavior
    Continue push operations using Websocket

Minimal reproducible example:
a repo that reproduces the problem: https://github.com/padisah/vaadin-jetty94-failure/

Reason of problem:
Jetty 9.3 -> 9.4 version change had a breaking change. They started treating Websocket session NOT as an HttpSession but a different session implementation for websockets. This new implementation doesn't provide JSESSIONID anymore.

Atmosphere has suffered from that change, so they had a fix over that, but Vaadin still tries to look up the HttpSession from the websocket upgraded connection's request.

PushHandler.class line 205
`
private void callWithUi(final AtmosphereResource resource,
final PushEventCallback callback, boolean websocket) {
AtmosphereRequest req = resource.getRequest();
VaadinServletRequest vaadinRequest = new VaadinServletRequest(req,
service);
VaadinSession session = null;
if (websocket) {
// For any HTTP request we have already started the request in the
// servlet
service.requestStart(vaadinRequest, null);
}
try {
try {
session = service.findVaadinSession(vaadinRequest); // here pushandler starts looking up an HttpSession

`
above call continues to:

line 949, VaadinService.getWrappedSession

Switching to JSR356AsyncSupport instead starts the application, but the log is constantly filled with error messages realted to failed push operations, and it actually fails with a higher load when multiple browsers need to get pushes frequently. I would rather use a jetty-specific websocket implementation.

references:
https://vaadin.com/forum/thread/17053341/session-immediately-expires-after-upgrade-jetty-server-to-9-4-6

https://github.com/Atmosphere/atmosphere/issues/2241

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the minimal reproducer and inspect PushHandler.java around line 205, where the websocket path calls service.findVaadinSession. Then trace VaadinService.getWrappedSession around line 949 and review the linked Atmosphere issue for the Jetty 9.4 session behavior. Done means websocket push continues without an immediate Session Expired response under the reproducer.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.