This Bugzilla instance is a read-only archive of historic NetBeans bug reports. To report a bug in NetBeans please follow the project's instructions for reporting issues.

Bug 35128 - Ensure that sessions are cleared on execute/force reload
Summary: Ensure that sessions are cleared on execute/force reload
Status: NEW
Alias: None
Product: serverplugins
Classification: Unclassified
Component: Tomcat (show other bugs)
Version: 3.x
Hardware: All All
: P3 blocker with 1 vote (vote)
Assignee: Petr Hejl
URL: http://jakarta.apache.org/tomcat/tomc...
Keywords:
Depends on:
Blocks:
 
Reported: 2003-07-24 18:37 UTC by Ana.von Klopp
Modified: 2007-08-30 17:36 UTC (History)
3 users (show)

See Also:
Issue Type: ENHANCEMENT
Exception Reporter:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ana.von Klopp 2003-07-24 18:37:04 UTC
I'm filing this issue in response to a thread on nbusers. 
I'm having a hard time with the classification - perhaps 
this is an enhancement, but it's pretty high priority in 
that case. 

Vrata (in CC line) noticed that when he re-executed a web 
application, it appeared that the session data was 
persisted (that is, the old session data was recreated on 
restart). It turns out that this is a Tomcat "feature": 

"If you haven't got a Manager explicitly added in the 
server.xml a default is used (stores serialized sessions in 
a file SESSIONS.ser under the work directory. If you don't 
fancy changing the server.xml you can delete all SESSIONS.
ser under work before you start tomcat)". (See URL in URL 
field for more details). 

This might be a useful feature in a production setting, but 
in a development setting, one probably expects to have the 
data go away, especially since there is no trivial way of 
clearing it from a running server. So I think that our 
Tomcat integration should be configured in such a way that 
session data is thrown away on a restart. 

Hm, clearing a session while the web module is running 
would be a fairly simple feature for the monitor to 
implement. Would this be a useful feature also?
Comment 1 Milan Kuchtiak 2003-08-05 14:12:07 UTC
There is a cookies attribute in the <Context> element in server.xml
file. I think, for test execution, it is more natural to set this
attribute to false(the default value is true). If cookies atribute is
set to false, no SESSION.ser files are created when web modules are
reloaded.

Is this a satisfactory solution ?
Comment 2 avenet 2003-08-05 15:26:09 UTC
Hello Milan,

what you say is not quite right am afraid.  You are right in pointing
out one can set the boolean cookies to false in a Context, but that
only prevents cookies from being passed to the browser.  This also
means that seesion tracking is lost as a result (ie, one needs to
implement session tracking using html headers or something else--
tomcat tracks sessions by default using cookies!).  It doest *not* get
rid of the session.ser file!  It also means that if you track wether a
session is logged in or not, then your app will fail and keep on
asking for authentification (I tried it!).

There is only one way to stop session persistance between server
restarts and that is by declaring explicitly the PersistentManager
(<Manager clas="org.apache.catalina.session.PersistentManager">)
within the <Context> and setting the saveOnRestart="false".  

for more info, see: 
http://jakarta.apache.org/tomcat/tomcat-4.1-doc/config/manager.html

Stopping session persistance when developing in netbeans is
recommended.  There is two way I see of achieving this.  Either
declare an explicit <Manager> for each new web-module, or delete the
Context in the Tomcat server when the Execute (force reload) command
is invoked.  This last option is relatively easy with the
Tomcat/4.1.24 or higher, for upon starting, the manager application
can be invoked to remove + (re)deploy the application being developed.
(see
http://jakarta.apache.org/tomcat/tomcat-4.1-doc/manager-howto.html#Remove%20an%20Existing%20Application)

I am using this facility with a local tomcat server through an ant
script deployed in nb.


kind regards,

Vrata

PS: I had a quick look at tomcat/5.0 and it looks like it is the same
configuration methods for switching off persistance.  I will post a
note on their mail list to see if there is any 'global' way of
switching off persistance for all apps on a server.  Maybe there is an
easier way to solve this problem, yet!
Comment 3 Milan Kuchtiak 2003-08-05 17:05:00 UTC
Vrata, 

You're right about the cookies attribute - we shouldn't set it to false.

I tried to use your recommendation with the <Manager> element (nested
inside the <Context> element) but with no success
I was not really able to prevent Tomcat from the session serialization.

The easiest seems to be removing the SESSION.ser file from work
directory before loading a web module. 

However, I hasitate whether this is a desired behaviour.
One may have the session persistant while restarting.

In Nb3.5 the Manager application is used restricdedly when there are
recognized only the servlet changes. We plan to use the Manager
application more intensively for future releases.
Comment 4 avenet 2003-08-05 17:47:11 UTC
Hola Milan,

that was a quick reply!    I manage to get the Manager to work,
alhtough I have to admit that I did struggle with it as well.  Here is
my Context as it appears in my server.xml file.

<Context path="/XAT" docBase="XAT.war" debug="0"
  reloadable="false" crossContext="true" swallowOutput="true">
         
  <Logger className="org.apache.catalina.logger.FileLogger"
       prefix="localhost_XAT_log." suffix=".txt"
       timestamp="true"/>
     
  <Manager className="org.apache.catalina.session.PersistentManager"
    debug="5"
    saveOnRestart="false"
    maxActiveSessions="-1"
    minIdleSwap="-1"
    maxIdleSwap="-1"
    maxIdleBackup="-1">
      <Store className = "org.apache.catalina.session.FileStore" />
  </Manager>
</Context>


note, you need to set all these other values to -1 in order for it not
to persist!  Maybe that's where you went wrong (?).

as for:

>The easiest seems to be removing the SESSION.ser file from work
>directory before loading a web module.
>
I agree, that seems like a simple enough solution, however, I read on
the mail list some exchanges about the need sometimes to delete a
context from the server.  Context deleting could be a way to make
things a little cleaner.... don't know really, just a suggestion!

>However, I hasitate whether this is a desired behaviour.
>One may have the session persistant while restarting.
>
Sure, I can understand that.  Maybe then there could be a possibility
of tuning this from the options panel!?  This way it could be set on a
per project basis!

thanks for taking the time to persue this issue,

Vrata

PS: I have posted a question on the tomcat-user mailing list, but I
have had no answers yet!
Comment 5 avenet 2003-09-09 14:26:27 UTC
Hi Milan,

given the recent question on the user list, I realised that I forgot
to mention another possible solution.  This involves the
DefaultContext tag in the server.xml descriptor file.  The
DefaultContext allows to set general properties for *all* contexts
that get deployed on the server.  These general props can be
overridden using their own Context declaration.  Hence to apply
session managers to all debugged contexts, this default context could
be inserted into the server.xml file that comes with NB.  
One way to come to a simple solution would be to define run and debug
tomcat servers.  It is possible to define CATYALINA_HOME and
CATALINA_BASE vars (normally they point to the same dir) so that the
base dir is changed from run to debug directories depending on how the
app is run in NB.  Because each base installations have their own
configuration files (they only share the tomcat libraries that sit in
the home dir), then the debug version could have the non-persistent
default ocntext inserted into its server.xml file...

This would be (I think) simple enough to set up.  Although it may
prove itself cumbersome, it could satisfy the needs of current users
for the time being.

good luck

Vrata
Comment 6 Milan Kuchtiak 2004-02-25 19:26:58 UTC
The feature still wasn't implemented for Tomcat5.
Comment 7 Milan Kuchtiak 2004-02-25 19:29:37 UTC
The proposed 
solution with org.apache.catalina.session.PersistentManager
inside the Context file can be implemented for Promo-D.
Comment 8 Milan Kuchtiak 2004-02-26 08:34:01 UTC
The session persistance control is a useful feature that can be
implemented as web module property in Promo-D.
Comment 9 avenet 2004-02-26 10:26:18 UTC
ok, sounds good.  I guess you don't need anything else from me.  I
keep tracking this issue, but I have to admit that the details of
which have been blurred a little with the passing of time.  Let me
know if you would like me to test any new builds.  
Comment 10 Milan Kuchtiak 2005-10-04 14:56:41 UTC
Is there an easy way to remove the session or to set up the Tomcat 5
PersistentManager in IDE ?
I guess we still don't have other solution except of manual context.xml editing.