Re: [Springframework-developer] SWF - Creating HTTP sessions - Feedback needed

[James E. <jam...@gm...>]

I was actually digging through the code earlier and debating the same
thing.  My first instinct was that it should create one for me if it
is required anyway.  I was thinking it would make sense to add a
boolean 'createSessionIfNecessary' field on the
org.springframework.web.servlet.support.WebContentGenerator.  If true,
the session will be created, otherwise an exception will be thrown as
it is now.

The only downside I could think of was when the session times-out
while mid-flow (user waits too long) and data from the previous steps
in the flow are not present (and the next steps are assuming the data
is present).  I'm not sure what problems this could lead to...it would
certainly need to be tested.  One could argue though that if you have
security filters in place, you would'nt get that far anyway...and with
acegi this is probably true.  However with websphere 5.1, the user
authentication is not (or doesn't appear to be) tied to the session
(see below for explaination).  I wouldn't say this is reason to avoid
auto-creating the session...we just need to be aware of the possible
side-effects.

I haven't given Web Flow the full looking over yet so pardon me if
this is a rediculous question, but is there anyway it can support
flows without session (in-addition-to not instead-of)?  Perhaps by
passing the 'current-state' along with the request...and not allowing
flow-scoped attributes in these cases?  I imagine situations where it
would be nice to define flows for visiting users...and not want to
have a session created for all visitors.



When using container managed security in WAS5.1, IF the 'logout'
action simply invalidates the session, webshpere still thinks the user
is authenticated (they have a magic ibm_security_logout uri that must
be hit to clear the user authentication).  I never tested what happens
to the authenication info when a session-timeout occurs...and I don't
have access to a 5.1 machine now...but if it does not become
invalidated when the session does, then websphere would happily say:
"hey, you're authenticated, come on in" and then the session will be
created (empty) for the mid-flow request.  This little change (didn't
happen in 5.0..only 5.1) caused some grief on my last project.

James


On Thu, 31 Mar 2005 21:36:32 +0200, Erwin Vervaet
<erw...@er...> wrote:
> The Spring Web Flow (SWF) FlowController forces the "requireSession"
> property it inherits from AbstractController to "true". This is logical
> since the webflow system needs to store flow execution state in the HTTP
> session.
> 
> So far so good. However, since the controller now requires an existing
> session, the user/developer is responsible for creating that session before
> a flow is started. This is typically not a problem in real-life applications
> since those carefully manage session creation and invalidation.
> 
> Still, we are wondering whether it is a good idea to implicitly create
> sessions (usually using request.getSession()) in a controller, or should
> this be left as a responsability of the application developer? Note that
> AbstractWizardFormController and AbstractFormController implicitly create
> sessions.
> 
> Erwin Vervaet
> erw...@er...
> 
> -------------------------------------------------------
> This SF.net email is sponsored by Demarc:
> A global provider of Threat Management Solutions.
> Download our HomeAdmin security software for free today!
> http://www.demarc.com/info/Sentarus/hamr30
> _______________________________________________
> Springframework-developer mailing list
> Spr...@li...
> https://lists.sourceforge.net/lists/listinfo/springframework-developer
>