This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch tomee-10.x in repository https://gitbox.apache.org/repos/asf/tomee.git
commit 30ea7652140e3693a75a50473f5588bb5cdbbc3d Author: Markus Jung <[email protected]> AuthorDate: Sat Aug 29 21:08:03 2026 +0200 fully change session id in openejb-http (cherry picked from commit f96fc43537274503928d6909ec86d666500129c2) --- .../apache/openejb/server/httpd/HttpRequestImpl.java | 8 ++++++-- .../apache/openejb/server/httpd/HttpSessionImpl.java | 6 ++++++ .../openejb/server/httpd/session/SessionManager.java | 7 +++++++ .../openejb/server/httpd/HttpRequestImplTest.java | 17 +++++++++++++++++ 4 files changed, 36 insertions(+), 2 deletions(-) diff --git a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpRequestImpl.java b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpRequestImpl.java index 401877d696..d73c2de1d6 100644 --- a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpRequestImpl.java +++ b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpRequestImpl.java @@ -1030,8 +1030,12 @@ public class HttpRequestImpl implements HttpRequest { @Override public String changeSessionId() { if (session != null) { - if (HttpSessionImpl.class.isInstance(session)) { - HttpSessionImpl.class.cast(session).newSessionId(); + jakarta.servlet.http.HttpSession delegate = session; + while (ServletSessionAdapter.class.isInstance(delegate)) { + delegate = ServletSessionAdapter.class.cast(delegate).session; + } + if (HttpSessionImpl.class.isInstance(delegate)) { + HttpSessionImpl.class.cast(delegate).newSessionId(); } return session.getId(); } diff --git a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpSessionImpl.java b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpSessionImpl.java index 5968138209..2de49f2938 100644 --- a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpSessionImpl.java +++ b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/HttpSessionImpl.java @@ -62,7 +62,13 @@ public class HttpSessionImpl implements HttpSession { } public void newSessionId() { + final String oldId = this.sessionId; this.sessionId = UUID.randomUUID().toString(); + + final SessionManager sessionManager = SystemInstance.get().getComponent(SessionManager.class); + if (sessionManager != null) { + sessionManager.changeSessionId(oldId, this.sessionId); + } } @Override diff --git a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/session/SessionManager.java b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/session/SessionManager.java index 9a6c61e12d..34138b1639 100644 --- a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/session/SessionManager.java +++ b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/session/SessionManager.java @@ -120,6 +120,13 @@ public class SessionManager { sessions.remove(sessionId); } + public void changeSessionId(final String oldId, final String newId) { + final SessionWrapper wrapper = sessions.remove(oldId); + if (wrapper != null) { + sessions.put(newId, wrapper); + } + } + public Collection<String> findSessionIds() { return sessions.keySet(); } diff --git a/server/openejb-http/src/test/java/org/apache/openejb/server/httpd/HttpRequestImplTest.java b/server/openejb-http/src/test/java/org/apache/openejb/server/httpd/HttpRequestImplTest.java index afc33490da..3f129616ea 100644 --- a/server/openejb-http/src/test/java/org/apache/openejb/server/httpd/HttpRequestImplTest.java +++ b/server/openejb-http/src/test/java/org/apache/openejb/server/httpd/HttpRequestImplTest.java @@ -29,8 +29,10 @@ import java.net.URISyntaxException; import java.nio.charset.StandardCharsets; import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotEquals; import static org.junit.Assert.assertNotNull; import static org.junit.Assert.assertNull; +import static org.junit.Assert.assertSame; import static org.junit.Assert.assertTrue; import static org.junit.Assert.fail; @@ -54,6 +56,21 @@ public class HttpRequestImplTest { assertNull(req.getSession(false)); } + @Test + public void changeSessionIdRekeysSession() throws URISyntaxException { + final HttpRequestImpl req = new HttpRequestImpl(new URI("http://localhost:1234/foo";)); + final jakarta.servlet.http.HttpSession session = req.getSession(); + final String oldId = session.getId(); + + final String newId = req.changeSessionId(); + + assertNotEquals(oldId, newId); + final SessionManager sessionManager = SystemInstance.get().getComponent(SessionManager.class); + assertNull(sessionManager.findSession(oldId)); + assertNotNull(sessionManager.findSession(newId)); + assertSame(session, sessionManager.findSession(newId).session); + } + @Test public void initContext() throws URISyntaxException { final HttpRequestImpl req = new HttpRequestImpl(new URI("http://localhost:1234/api/foo/bar";));
