(tomee) branch main updated: fully change session id in openejb-http

[jungm]

This is an automated email from the ASF dual-hosted git repository.

jungm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomee.git


The following commit(s) were added to refs/heads/main by this push:
     new f96fc43537 fully change session id in openejb-http
f96fc43537 is described below

commit f96fc43537274503928d6909ec86d666500129c2
Author: Markus Jung <ju...@apache.org>
AuthorDate: Sat Aug 29 21:08:03 2026 +0200

    fully change session id in openejb-http
---
 .../apache/openejb/server/httpd/HttpRequestImpl.java    |  8 ++++++--
 .../apache/openejb/server/httpd/HttpSessionImpl.java    |  6 ++++++
 .../openejb/server/httpd/session/SessionManager.java    |  7 +++++++
 .../openejb/server/httpd/HttpRequestImplTest.java       | 17 +++++++++++++++++
 4 files changed, 36 insertions(+), 2 deletions(-)

diff --git 
a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpRequestImpl.java
 
b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpRequestImpl.java
index 401877d696..d73c2de1d6 100644
--- 
a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpRequestImpl.java
+++ 
b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpRequestImpl.java
@@ -1030,8 +1030,12 @@ public class HttpRequestImpl implements HttpRequest {
     @Override
     public String changeSessionId() {
         if (session != null) {
-            if (HttpSessionImpl.class.isInstance(session)) {
-                HttpSessionImpl.class.cast(session).newSessionId();
+            jakarta.servlet.http.HttpSession delegate = session;
+            while (ServletSessionAdapter.class.isInstance(delegate)) {
+                delegate = ServletSessionAdapter.class.cast(delegate).session;
+            }
+            if (HttpSessionImpl.class.isInstance(delegate)) {
+                HttpSessionImpl.class.cast(delegate).newSessionId();
             }
             return session.getId();
         }
diff --git 
a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpSessionImpl.java
 
b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpSessionImpl.java
index 5968138209..2de49f2938 100644
--- 
a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpSessionImpl.java
+++ 
b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpSessionImpl.java
@@ -62,7 +62,13 @@ public class HttpSessionImpl implements HttpSession {
     }
 
     public void newSessionId() {
+        final String oldId = this.sessionId;
         this.sessionId = UUID.randomUUID().toString();
+
+        final SessionManager sessionManager = 
SystemInstance.get().getComponent(SessionManager.class);
+        if (sessionManager != null) {
+            sessionManager.changeSessionId(oldId, this.sessionId);
+        }
     }
 
     @Override
diff --git 
a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/session/SessionManager.java
 
b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/session/SessionManager.java
index 9a6c61e12d..34138b1639 100644
--- 
a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/session/SessionManager.java
+++ 
b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/session/SessionManager.java
@@ -120,6 +120,13 @@ public class SessionManager {
         sessions.remove(sessionId);
     }
 
+    public void changeSessionId(final String oldId, final String newId) {
+        final SessionWrapper wrapper = sessions.remove(oldId);
+        if (wrapper != null) {
+            sessions.put(newId, wrapper);
+        }
+    }
+
     public Collection<String> findSessionIds() {
         return sessions.keySet();
     }
diff --git 
a/server/openejb-http/src/test/java/org/apache/openejb/server/httpd/HttpRequestImplTest.java
 
b/server/openejb-http/src/test/java/org/apache/openejb/server/httpd/HttpRequestImplTest.java
index afc33490da..3f129616ea 100644
--- 
a/server/openejb-http/src/test/java/org/apache/openejb/server/httpd/HttpRequestImplTest.java
+++ 
b/server/openejb-http/src/test/java/org/apache/openejb/server/httpd/HttpRequestImplTest.java
@@ -29,8 +29,10 @@ import java.net.URISyntaxException;
 import java.nio.charset.StandardCharsets;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertSame;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 
@@ -54,6 +56,21 @@ public class HttpRequestImplTest {
         assertNull(req.getSession(false));
     }
 
+    @Test
+    public void changeSessionIdRekeysSession() throws URISyntaxException {
+        final HttpRequestImpl req = new HttpRequestImpl(new 
URI("http://localhost:1234/foo";));
+        final jakarta.servlet.http.HttpSession session = req.getSession();
+        final String oldId = session.getId();
+
+        final String newId = req.changeSessionId();
+
+        assertNotEquals(oldId, newId);
+        final SessionManager sessionManager = 
SystemInstance.get().getComponent(SessionManager.class);
+        assertNull(sessionManager.findSession(oldId));
+        assertNotNull(sessionManager.findSession(newId));
+        assertSame(session, sessionManager.findSession(newId).session);
+    }
+
     @Test
     public void initContext() throws URISyntaxException {
         final HttpRequestImpl req = new HttpRequestImpl(new 
URI("http://localhost:1234/api/foo/bar";));