{"id":18370689,"url":"https://github.com/mcfoggy/jsessionid-concurrency","last_synced_at":"2026-04-28T08:02:25.871Z","repository":{"id":72120376,"uuid":"81225678","full_name":"McFoggy/jsessionid-concurrency","owner":"McFoggy","description":"jee SPA demo app to reproduce JSESSIONID bad behavior","archived":false,"fork":false,"pushed_at":"2017-02-13T15:35:47.000Z","size":15,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-02-15T21:19:41.726Z","etag":null,"topics":["jee","jee7","maven","undertow","wildfly"],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/McFoggy.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-02-07T15:53:41.000Z","updated_at":"2017-02-07T15:56:36.000Z","dependencies_parsed_at":null,"dependency_job_id":"c1bf3e20-1523-4a6d-8faf-1e211fe2d734","html_url":"https://github.com/McFoggy/jsessionid-concurrency","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/McFoggy%2Fjsessionid-concurrency","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/McFoggy%2Fjsessionid-concurrency/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/McFoggy%2Fjsessionid-concurrency/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/McFoggy%2Fjsessionid-concurrency/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/McFoggy","download_url":"https://codeload.github.com/McFoggy/jsessionid-concurrency/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248300319,"owners_count":21080702,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["jee","jee7","maven","undertow","wildfly"],"created_at":"2024-11-05T23:39:52.280Z","updated_at":"2026-04-28T08:02:20.832Z","avatar_url":"https://github.com/McFoggy.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Sample app to demo JSESSIONID problems on SPA startup\n\nThis project is used as a demo project for a javaee war based SPA application using secured endpoints\nand some HttpSession caching stuff.\n\nProblematic has been exposed in a [post](http://lists.jboss.org/pipermail/undertow-dev/2017-February/001879.html) to the undertow mailing list ; read more [here](http://lists.jboss.org/pipermail/undertow-dev/2017-February/001879.html).\n\n## Problem description\n\nWhen the app starts the following occures\n- SPA application is accessed on a secured URL (index.html or time.html _see below for differences_)\n- once loaded (`$(document).ready()` as demoed using jquery)\n    - a first secured business endpoint `/init` is called. This endpoints initializes some data and put them in the HTTP session\n    - once this call is successfully performed 20 other business endpoints `/data` are called (imagine some configuration loading or something else) and use the HTTP Session data to perform some logic\n\nDue to some race conditions on client side \u0026 to default JSESSIONID handling server side (session id change on login) several business calls to `/data` can fail.\n\nHere is an example of an execution of the SPA at [http://localhost:8080/sessionid/index.html](http://localhost:8080/sessionid/index.html)\n\n\u003e The application logs/shows messages in which `[X::Y]` information correspond to:\n\u003e  - _X_ the JSESSIONID received by the server, ie the one sent by the client (or null if none was received) \n\u003e  - _Y_ the JSESSIONID used by the server \n\n```\ninit at: /init [null::QAYLSwZSSu2pDQMaxnkTAkzciteWKKV-3YDDpzpD] application id generated: 3\n0 -\u003e /data [QAYLSwZSSu2pDQMaxnkTAkzciteWKKV-3YDDpzpD::Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7] data initialized for client{0} on app {3}\nFAILURE: 3 :: /data no http session found for requested HTTP session id: QAYLSwZSSu2pDQMaxnkTAkzciteWKKV-3YDDpzpD\nFAILURE: 1 :: /data no http session found for requested HTTP session id: QAYLSwZSSu2pDQMaxnkTAkzciteWKKV-3YDDpzpD\nFAILURE: 6 :: /data no http session found for requested HTTP session id: QAYLSwZSSu2pDQMaxnkTAkzciteWKKV-3YDDpzpD\nFAILURE: 2 :: /data no http session found for requested HTTP session id: QAYLSwZSSu2pDQMaxnkTAkzciteWKKV-3YDDpzpD\nFAILURE: 4 :: /data no http session found for requested HTTP session id: QAYLSwZSSu2pDQMaxnkTAkzciteWKKV-3YDDpzpD\nFAILURE: 8 :: /data no http session found for requested HTTP session id: QAYLSwZSSu2pDQMaxnkTAkzciteWKKV-3YDDpzpD\nFAILURE: 5 :: /data no http session found for requested HTTP session id: QAYLSwZSSu2pDQMaxnkTAkzciteWKKV-3YDDpzpD\nFAILURE: 7 :: /data no http session found for requested HTTP session id: QAYLSwZSSu2pDQMaxnkTAkzciteWKKV-3YDDpzpD\n10 -\u003e /data [Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7::Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7] data initialized for client{10} on app {3}\nFAILURE: 9 :: /data no http session found for requested HTTP session id: QAYLSwZSSu2pDQMaxnkTAkzciteWKKV-3YDDpzpD\n13 -\u003e /data [Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7::Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7] data initialized for client{13} on app {3}\n11 -\u003e /data [Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7::Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7] data initialized for client{11} on app {3}\n14 -\u003e /data [Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7::Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7] data initialized for client{14} on app {3}\n12 -\u003e /data [Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7::Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7] data initialized for client{12} on app {3}\n16 -\u003e /data [Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7::Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7] data initialized for client{16} on app {3}\n18 -\u003e /data [Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7::Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7] data initialized for client{18} on app {3}\n19 -\u003e /data [Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7::Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7] data initialized for client{19} on app {3}\n17 -\u003e /data [Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7::Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7] data initialized for client{17} on app {3}\n15 -\u003e /data [Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7::Kr6hXPeKMXHIHpSJYSHdYxGvhtbjtTbi9yXRWLb7] data initialized for client{15} on app {3}\n```\n\n## Scenarios\n\n- [standard SPA](#standard-spa): no modifications the bug occures everytime \n- [stabilized JSESSIONID](#stabilized-jsession-spa): introduction of unecessary sequential businees call before firing multiple asynchronuous data load calls\n- [prevent sessionId change SPA](#undertow-servlet-extension-spa): usage of an undertow ServletExtension to prevent new JSESSIONID to be generated  \n\n### standard SPA\n \nHow to reproduce:\n- start wildly: `mvn clean wildfly:run`\n- deploy the app: `mvn wildfly:deploy`\n- open your browser, clean `localhost` cookies\n- navigate to [http://localhost:8080/sessionid/index.html](http://localhost:8080/sessionid/index.html)\n    - log into the app using: `user/u` \n- stop wildly: `mvn clean wildfly:shutdown`\n\nNotice all `/data` calls fired asynchronously after the initial call to `/init`.\n\n### stabilized JSESSION SPA\n\nHow to reproduce:\n- start wildly: `mvn clean wildfly:run`\n- deploy the app: `mvn wildfly:deploy`\n- open your browser, clean `localhost` cookies\n- navigate to [http://localhost:8080/sessionid/time.html](http://localhost:8080/sessionid/time.html)\n    - log into the app using: `user/u` \n- stop wildly: `mvn clean wildfly:shutdown`\n\nNotice the sequential call to `/time` endpoint after the initial call to `/init` and before all `/data` asynchronous calls.\nThis `/time` calls makes the regeneration of the JSESSIONID to occure before the `/data` are fired and thus those calls are performed using a stable JSESSIONID. \n\n### undertow servlet extension SPA\n\nIn this scenario we use an undertow ServletExtension, [DoNotChangeSessionIdOnLogin ](src/main/java/com/agfa/sample/jee/control/undertow/DoNotChangeSessionIdOnLogin.java) to disable the _ChangeSessionIdOnLogin_ functionnality.\n \nHow to reproduce:\n- start wildly: `mvn clean wildfly:run`\n- deploy the app with undertow extension: `mvn -Pundertow wildfly:deploy`\n- open your browser, clean `localhost` cookies\n- navigate to [http://localhost:8080/sessionid-undertow/index.html](http://localhost:8080/sessionid-undertow/index.html)\n    - log into the app using: `user/u` \n- stop wildly: `mvn clean wildfly:shutdown`\n\nNotice no rewrite of the JSESSIONID occures as the extension is active.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmcfoggy%2Fjsessionid-concurrency","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmcfoggy%2Fjsessionid-concurrency","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmcfoggy%2Fjsessionid-concurrency/lists"}