History | Log In     View a printable version of the current page.  
Issue Details (XML | Word | Printable)

Key: GRAILS-224
Type: Improvement Improvement
Status: Closed Closed
Resolution: Fixed
Priority: Blocker Blocker
Assignee: Marc Palmer
Reporter: Marc Palmer
Votes: 0
Watchers: 1
Operations

If you were logged in you would be able to see more operations.
Grails

Automatically synchronize access to session

Created: 21/Jul/06 08:30 AM   Updated: 26/Jan/07 02:28 PM
Component/s: Controllers
Affects Version/s: 0.2
Fix Version/s: 0.4

Time Tracking:
Not Specified

File Attachments: 1. Text File SynchronizedSessionPatch.txt (3 kb)



 Description  « Hide
Note that the synchronisation must be done in HttpSessionMap.

The object of this is to avoid the user making their code messy with explicit synchronized blocks, make session access from GSP safer, and generally to stop people having to know that you should be doing this (according to the servlet spec).



 All   Comments   Work Log   Change History      Sort Order: Ascending order - Click to sort in descending order
Marc Palmer - 25/Oct/06 02:37 AM
This is crucial because the Servlets Specification states that all session access should be synchronized. There are numerous hazards that show that there is never a safe time to access a session without synchronization:

#. Simultaneous requests on other threads are always possible if not inevitable when you factor in Ajax requests, image serving, templated CSS, rapid user clicks (i.e. clicking on a link in result page before the GSP has fully executed) etc
#. Session affinity across servers surely relies on synchronisation to ensure the state of the local session is coherent during exchanges of data between servers


Drew Varner - 03/Jan/07 01:27 PM
I don't have much experience with synchonization but this one looks straight foward. I used synchronized methods rather than synchonized blocks in the methods because I don't see too much benefit in messing with fine-grained locking and the performance difference seems minimal. I don't see a way to unit test this

There's a good (heated) discussion of the issue here:
http://issues.apache.org/bugzilla/show_bug.cgi?id=36541

It seems like some containers may already synchronize some (or all) methods of the session.


Marc Palmer - 03/Jan/07 01:43 PM
I have already begun work on the unit test for this, pending some Groovy/threading issues.

Thanks for the patch, I will check it out once we have a unit test that fails


Marc Palmer - 03/Jan/07 02:15 PM
Happy happy joy joy, that Tomcat bugzilla discussion is crazy.

Thing is, they say that Servlets spec 2.5 will clarify this issue. I cannot find a copy of the Servlet 2.5 spec PDF (as opposed to the javadocs) and so I cannot see what, if anything, they have indeed changed.

The only way to be sure we are safe though, is to sync it ourselves. It's clear that there are containers out there, i.e. Tomcat 5.x, which do not sync session and hence can lead to corruption even without clustering.


Drew Varner - 03/Jan/07 10:17 PM
My take-away from the heated discussion on the Tomcat list is that the overhead of synchonization (at least as measured via microbenchmarks) is negligible, so why not be safe.

Marc Palmer - 04/Jan/07 04:25 AM
Yes me too - but even if they weren't we need to be safe. We don't want to end up saying "Grails won't run reliably on container X or Y"