ServletRequestAttributes wrongly returns a null http session on child threads. [SPR-4433]

[spring-projects-issues]

Sergio Bossa opened SPR-4433 and commented

The protected ServletRequestAttributes#getSession(boolean ) method returns a null session on child threads. This is wrong because it doesn't get into account what happens in the constructor:

[code] public ServletRequestAttributes(HttpServletRequest request) { Assert.notNull(request, "Request must not be null"); this.request = request; // Fetch existing session reference early, to have it available even // after request completion (for example, in a custom child thread). this.session = request.getSession(false); } [/code]

I think that the following code into the getSession method:

[code] this.session = this.request.getSession(allowCreate); return this.session; [/code]

Should be as follows:

[code] HttpSession newSession = this.request.getSession(allowCreate); if (newSession != null) { this.session = newSession; } return this.session; [/code]

---

Affects: 2.0.8

Issue Links:

• 9112 ServletRequestAttributes wrongly returns a null http session on child threads. ("duplicates")

[spring-projects-issues]

Sergio Bossa commented

Duplicates #9112 because of a Jira fault.