Re: [Geoserver-users] Session timeout for GeoServer

[Saul F. <Sau...@st...>]

Chris,

I think I understand the confusion.

Every time you make a request to a servlet container, the servlet 
container has the opportunity to create a 
"javax.servlet.http.HttpSession".  Generally this is done by having some 
code running in the servlet container call 
"HttpServletRequest.getSession(boolean b)"

This session object then causes the response headers in the 
HttpServletResponse to include a cookie (by default, at least) and it's 
then assumed by the servlet container that subsequent requests from that 
same host will cause the internal of the container to link up that 
HttpSession object with incoming HttpRequests (keyed by the browsers 
cookie value).

This is the basic mechanism for server-side statefulness in J2EE.


However, WMS/WFS are stateless, so there's no need to create these 
"HttpSession" objects and store them in a big hashtable somewhere inside 
tomcat, waiting for a browser's JSESSIONID cookie that's never going to 
show up.


"Now wait!" you're probably saying.  "geoserver doesn't call 
'getSession(boolean b)' explicitly anywhere!  We don't MAKE those 
sessions, knowing that we're a stateless program!"

Except that that's not true:

sfarber@env-ws-sflinux geoserver-trunk $ find . -name "*.java" | xargs 
-l1 grep -nHri getSession | wc -l
67
sfarber@env-ws-sflinux geoserver-trunk $


So every geoserver request calls 'getSession()', thereby forcing the 
container to create a new session object, and those session objects 
(while relatively small) do stick around in the container session 
storage for a while.


I think the fix is to try and replace calls to "getSession" with calls 
to "getRequest" and see if we can get the info we're looking for from 
some place else in the API.

Make sense?

--saul

> What resources does it hold on to?  If it's not releasing resources then 
> that's a problem.  But I don't quite understand the number of sessions 
> growing fast, when wms and wfs are stateless.  Or do we just need to set 
> a default of expiring sessions after a minute or so?  A new session is 
> created for every WMS/WFS call?  I'm not sure what resources are being 
> held on to though, as I'm pretty positive we release all the database 
> connections and whatnot right away.
> 
> best regards,
> 
> Chris