[Springframework-developer] Potentialt dangerous hibernate Session reuse

[Per O. <po...@no...>]

Hi,

I have a comment/question to how spring handles threadlocal bound session in 
case of exception and rollback.

We are using spring with hibernate and the OpenSessionInViewFilter. This way 
we get the hibernate Session bound to thread local and reused throughout 
request. We've done this from spring 1.0.1 and on.

At some point in time, we experienced, that changes on hibernate Session were 
being committed even though an exception was thrown and spring rolled tx 
back. We found this was due to the hibernate session bound to thread being 
reused.

Then, in spring release 1.1.2, I saw this was fixed in 
HibernateTransactionManager (v1.40) by calling session.clear() when an 
exception occurs.

Even though this works with current hibernate release, I find this to be a bit 
insecure. The hibernate docs on Session class explicitly says:

   " If the Session throws an exception, the transaction 
    must be rolled back and the session discarded. 
    The internal state of the Session might not be 
    consistent with the database after the exception occurs."

On the other hand, apidocs for clear() says:

  "Completely clear the session. Evict all loaded instances 
   and cancel all pending saves, updates and deletions. 
   Do not close open iterators or instances of ScrollableResults"

But should we not adhere to the class docs on Session, and throw away the 
hibernate session that was bound to threadlocal when an exception occurs? I 
think that would be most save, would it not? After all, the class docs does 
*not* say that you can either throw away session or call clear().

In our app, we've made a solution where we extend OpenSessionInViewFilter and 
override the getSession() method to return a proxied instance which, in case 
of exception, refuses to dispatch methods to the hibernate session anymore. 
This solution will render the session invalid and possibly make the 
application fail, but it will also completely ensure, that the session is not 
reused for anything in case of exception.

But I would much rather, that spring threw away the session from threadlocal 
(possibly binding a new one instead?) instead of calling clear(). Or, better 
yet, provide me with an option of getting either new session or clear() call.

What are your thoughts on this?

Regards, Per


-- 
Per Olesen @ Nordija A/S - www.nordija.com - main#: +45 70 20 25 10
email: po...@no... - cell#: +45 23 38 95 81