Access to variables scope in onSessionStart() is not thread safe

Description

If I use the following Application.cfc (with an empty index.cfm file):

component {

    this.name = 'testApp';
    this.sessionManagement = true;

    variables.templateId = createUuid();

    function onSessionStart() {
        request.templateId = variables.templateId;
    }

    function onRequestStart( string targetPage ) {
        writeOutput( "variables.templateId: " & variables.templateId );
        writeOutput( chr(10) );
        writeOutput( "request.templateId: " & request.templateId );
    }

}

and hit it with a number of simultaneous new session requests, there will always be at least one request where variables.templateId does not match request.templateId. Instead the outputted request.templateId will match the variables.templateId of one of the other requests.

Environment

None

Attachments

16 Apr 2018, 01:32 pm
12 Mar 2018, 03:46 pm
01 Mar 2018, 07:09 am
28 Feb 2018, 08:22 am
28 Feb 2018, 08:22 am

Linked issues

relates to

LDEV-1155

OnApplicationStart not always called

LDEV-3264

onSessionEnd() is never triggered when using JEE sessions

LDEV-3478

onSessionEnd() never triggered using sessionRotate()

Activity

Show:

Michael Offner 28 June 2018 at 20:15

https://github.com/lucee/Lucee/commit/f68af37180079ca281ed359d07c7ab531ace0f21

Michael Offner 28 June 2018 at 11:00

in case it fails 2 onSessionStart see the same "variables.templateId" value

Pothys - MitrahSoft 15 June 2018 at 14:38

Hi @Michael Offner,

Nope, I don't have test case for this. I did reproduced with above code in Jmeter only. It occurs very rarely to me. I attached my test plan. to reproduce this issue

Michael Offner 11 June 2018 at 12:41

very interesting!

@Pothys - MitrahSoft did you try to write a testcase for this?

do all request come with the same cookie (cfid)?
Lucee locks all request with the same cfid when "onSessionStart" is executed.
that means in case all have the same cfid only the first has set " request.templateId " all other have not.
This indicates that cookie.cfid is not send with the requests.

Pothys - MitrahSoft 16 April 2018 at 13:35

Hi @John Berquist,

I'm again tested this on jMeter & Issue reproduced rarely. The response date ID is mismatched only 1 time for 100 requests. I've attached the output of sample

file.

@Michael Offner will confirm about this issue.

Fixed

Details
Assignee
Michael Offner
Reporter
John Berquist
Priority
Critical
Fix versions
5.2.9.12
New Issue warning screen
Before you create a new Issue, please post to the mailing list first https://dev.lucee.org
Once the issue has been verified, one of the Lucee team will ask you to file an issue
Sprint
None
Affects versions
4.5.2.017

Created 21 October 2015 at 01:16

Updated 18 November 2021 at 10:23

Resolved 28 June 2018 at 20:16