Re: [WebMacro-user] Session integrity issue?

[Nikolaos P. <nk...@cc...>]

Hi all,

I am sending a cut (but indicative---I hope) version of the core servlet=20
I am using.
The userId variable is set into the session by the validateUser method.
Various other methods have been omitted in this version for readability=20
reasons.
Hope it is clear.

Thank you in advance
Nikolaos Papadakis

P.S. Just for the record the configuration I am using includes:
SuSe ver 10.0
Java 1.4.2
Tomcat 5.0.30 in conjunction with Apache ver 2.0.53.
I also use some customized version of S2J to =E2=80=9Cobjectize=E2=80=9D =
tables and=20
relations in the db.





Keats Kirsch wrote:
> It's not possible to tell from the code snippet what is going wrong. =20
> The concurrency issue that Lane is referring to is fairly obscure=20
> (only affecting the #include directive with dynamic template names if=20
> I recall correctly) and not relevant here.
>
> The code as shown looks OK, but we can't see how the USERID is stored=20
> in the session, or how the user data is stored and retrieved based on=20
> this USERID.  The bug could be in the data access layer or the session=20
> management subsystem (which depends on your Servlet container), or in=20
> some caching mechanism.  It is unlikely, but not impossible that this=20
> could be a WebMacro bug.  If I had to guess, I would suspect that the=20
> code which actually retrieves the user data is not properly synchronize=
d.
>
> Send us a bit more information about your application, and maybe we=20
> can help you track this down.
>
> Keats
>
> Lane Sharman wrote:
>
>> Hi Nikolaos.
>>
>> This is most disturbing to hear about.
>>
>> First, there is a known concurrency issue with WM in 2.0 and possibly=20
>> in prior releases. If you look at the mail thread dating back for 45=20
>> days, you will definitely see it.
>>
>> My concern is that the webmacro instance, shared, and the context,=20
>> not shared, is improperly orchestrated for concurrency. The webmacro=20
>> instance is local to WMServlet. You might consider synchronizing=20
>> access to this variable as a trial fix in your local calls below.=20
>> This will introduce some serialization of web processing but it might=20
>> help to verify the solution.
>>
>> One thing you might consider trying is to use a different cache=20
>> handler. A few years ago, I wrote one and it is a part of the distro.=20
>> I have never had a problem using this cache handler.
>>
>> Lane
>>
>> --- Nikolaos Papadakis <nk...@cc...> wrote:
>>
>> From: Nikolaos Papadakis <nk...@cc...>
>> Date: Sat, 18 Feb 2006 10:50:33 +0200
>> To: web...@li...
>> Subject: [WebMacro-user] [WebMacro-user
>>
>> Hi all,
>>
>> I am using webmacro to develop a web-based application.
>> Things seemed to work fine till yesterday. A customer complained that =
he
>> managed to =E2=80=9Csee=E2=80=9D the account of another customer when =
he logged-in using
>> his own credentials (he send me a screen shot of the =E2=80=9Cview=E2=80=
=9D).
>> By inspecting the log file I found that both users have been logged-in
>> at the same time (the second customer logged in 3 sec after the first
>> customer).
>> The system has more than 1000 customers but this inconvenience happene=
d
>> for the first time yesterday (?).
>> It seems that different sessions have been mixed up.
>> The servlet includes a handle method and uses several other methods
>> (methods that write and read from a database).
>> All methods are defined in the same class (that extends WMServlet).
>> As far as I know servlets must not have instance variables (only local
>> variables -inside methods- to prevent data corruption and
>> inconsistencies). However in my servlet I use only one non local
>> variable (a Logger) and I don't think this is the cause of the problem.
>> As an attached file I send you a fragment of the before mentioned=20
>> servlet.
>> Can instance variables be defined in the case of a servlet that extend=
s
>> WMServlet? (I mean is it safe? or its not a good practice without
>> keeping precautions?)
>> Do you have any idea what can have caused this inconvenience ?
>> Is the use of methods inside the servlet thread-safe ?
>>
>> Please help!!!
>> Nikolaos Papadakis
>> ------------------------------------------------------- This SF.net=20
>> email is sponsored by: Splunk Inc. Do you grep through log files for=20
>> problems? Stop! Download the new AJAX search engine that makes=20
>> searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!=20
>> http://sel.as-us.falkag.net/sel?cmd=3Dk&kid=103432&bid#0486&dat=121642=
=20
>> _______________________________________________ Webmacro-user mailing=20
>> list Web...@li...=20
>> https://lists.sourceforge.net/lists/listinfo/webmacro-user=20
>
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log=20
> files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D103432&bid=3D230486&dat=
=3D121642
> _______________________________________________
> Webmacro-user mailing list
> Web...@li...
> https://lists.sourceforge.net/lists/listinfo/webmacro-user
>
>