Adding a Navbar to a stateless page causes a session to be created

[exabrial]

Open source work often goes unthanked, so thank you for being great stewards of BootFaces. We love the framework.

I'm not completely convinced this is a bug in BootsFaces, but I figured I'd log a bug anyway. We noticed that adding a Navbar (and likely any bootsfaces components) will cause a session to get created, even on a page with a stateless view. We're running Apache TomEE 7.0.6 which uses OpenWebBeans 1.7.6 and MyFaces 2.2.12. I grabbed a stack trace so you can see how it gets created.

It could be that CDIManagedBeanHandlerImpl needs to be a little smarter and not dip down into the session when on a stateless view.

SessionContext.<init>() line: 39	
CdiAppContextsService(WebContextsService).initSessionContext(Object) line: 480	
CdiAppContextsService(WebContextsService).startContext(Class<Annotation>, Object) line: 311	
BeginWebBeansListener.sessionCreated(HttpSessionEvent) line: 150	
StandardSession.tellNew() line: 388	
StandardSession.setId(String, boolean) line: 360	
StandardSession.setId(String) line: 341	
StandardManager(ManagerBase).createSession(String) line: 656	
Request.doGetSession(boolean) line: 3087	
Request.getSession(boolean) line: 2476	
RequestFacade.getSession(boolean) line: 896	
CdiAppContextsService(WebContextsService).lazyStartSessionContext(boolean) line: 820	
CdiAppContextsService(WebContextsService).getSessionContext(boolean) line: 737	
CdiAppContextsService(WebContextsService).getCurrentContext(Class<Annotation>) line: 277	
BeanManagerImpl.getContext(Class<Annotation>) line: 291	
SessionScopedBeanInterceptorHandler(NormalScopedBeanInterceptorHandler).getContextualInstance() line: 89	
SessionScopedBeanInterceptorHandler.getContextualInstance() line: 76	
SessionScopedBeanInterceptorHandler(NormalScopedBeanInterceptorHandler).get() line: 71	
ViewScopeBeanHolder$$OwbNormalScopeProxy0.generateUniqueViewScopeId() line: not available [local variables unavailable]	
CDIManagedBeanHandlerImpl.generateViewScopeId(FacesContext) line: 92	
ViewScopeProxyMap.getWrapped() line: 79	
ViewScopeProxyMap.get(Object) line: 119	
AddResourcesListener.addResource(String, String, String, String) line: 896	
AddResourcesListener.addResourceToHeadButAfterJQuery(String, String) line: 839	
Tooltip.addResourceFiles() line: 134	
NavBar.<init>() line: 52	
NativeConstructorAccessorImpl.newInstance0(Constructor<?>, Object[]) line: not available [native method]	
NativeConstructorAccessorImpl.newInstance(Object[]) line: 62	
DelegatingConstructorAccessorImpl.newInstance(Object[]) line: 45	
Constructor<T>.newInstance(Object...) line: 423	
Class<T>.newInstance() line: 442 [local variables unavailable]	
ApplicationImpl.createComponent(FacesContext, String) line: 1442	
ApplicationImpl.createComponent(FacesContext, String, String) line: 1405	
OwbApplication(ApplicationWrapper).createComponent(FacesContext, String, String) line: 123	
OmniApplication(ApplicationWrapper).createComponent(FacesContext, String, String) line: 123	
ComponentTagHandlerDelegate.createComponent(FaceletContext) line: 605	
ComponentTagHandlerDelegate.apply(FaceletContext, UIComponent) line: 285	
ComponentHandler(DelegatingMetaTagHandler).apply(FaceletContext, UIComponent) line: 50	
CompositeFaceletHandler.apply(FaceletContext, UIComponent) line: 46	
HtmlComponentHandler(DelegatingMetaTagHandler).applyNextHandler(FaceletContext, UIComponent) line: 55	
ComponentTagHandlerDelegate.apply(FaceletContext, UIComponent) line: 374	
HtmlComponentHandler(DelegatingMetaTagHandler).apply(FaceletContext, UIComponent) line: 50	
CompositeFaceletHandler.apply(FaceletContext, UIComponent) line: 46	
ViewHandler.apply(FaceletContext, UIComponent) line: 195	
CompositeFaceletHandler.apply(FaceletContext, UIComponent) line: 46	
NamespaceHandler.apply(FaceletContext, UIComponent) line: 59	
CompositeFaceletHandler.apply(FaceletContext, UIComponent) line: 46	
CompositeFaceletHandler.apply(FaceletContext, UIComponent) line: 46	
EncodingHandler.apply(FaceletContext, UIComponent) line: 48	
DefaultFacelet.apply(FacesContext, UIComponent) line: 189	
FaceletViewDeclarationLanguage.buildView(FacesContext, UIViewRoot) line: 477	
RenderResponseExecutor.execute(FacesContext) line: 78	
LifecycleImpl.render(FacesContext) line: 267	
FacesServlet.service(ServletRequest, ServletResponse) line: 200	
ApplicationFilterChain.internalDoFilter(ServletRequest, ServletResponse) line: 231	
ApplicationFilterChain.doFilter(ServletRequest, ServletResponse) line: 166	
WsFilter.doFilter(ServletRequest, ServletResponse, FilterChain) line: 52	
ApplicationFilterChain.internalDoFilter(ServletRequest, ServletResponse) line: 193	
ApplicationFilterChain.doFilter(ServletRequest, ServletResponse) line: 166	
RewriteFilter.doFilter(ServletRequest, ServletResponse, FilterChain) line: 226	
ApplicationFilterChain.internalDoFilter(ServletRequest, ServletResponse) line: 193	
ApplicationFilterChain.doFilter(ServletRequest, ServletResponse) line: 166	
ApplicationDispatcher.invoke(ServletRequest, ServletResponse, ApplicationDispatcher$State) line: 728	
ApplicationDispatcher.processRequest(ServletRequest, ServletResponse, ApplicationDispatcher$State) line: 470	
ApplicationDispatcher.doForward(ServletRequest, ServletResponse) line: 395	
ApplicationDispatcher.forward(ServletRequest, ServletResponse) line: 316	
HttpRewriteResultHandler.handleResult(Rewrite) line: 42	
RewriteFilter.rewrite(InboundServletRewrite<ServletRequest,ServletResponse>) line: 297	
RewriteFilter.doFilter(ServletRequest, ServletResponse, FilterChain) line: 198	
ApplicationFilterChain.internalDoFilter(ServletRequest, ServletResponse) line: 193	
ApplicationFilterChain.doFilter(ServletRequest, ServletResponse) line: 166	
StandardWrapperValve.invoke(Request, Response) line: 199	
StandardContextValve.invoke(Request, Response) line: 96	
OpenEJBValve.invoke(Request, Response) line: 44	
NonLoginAuthenticator(AuthenticatorBase).invoke(Request, Response) line: 493	
StandardHostValve.invoke(Request, Response) line: 137	
ErrorReportValve.invoke(Request, Response) line: 81	
OpenEJBSecurityListener$RequestCapturer.invoke(Request, Response) line: 97	
AccessLogValve(AbstractAccessLogValve).invoke(Request, Response) line: 660	
StandardEngineValve.invoke(Request, Response) line: 87	
CoyoteAdapter.service(Request, Response) line: 343	
Http11Processor.service(SocketWrapperBase<?>) line: 798	
Http11Processor(AbstractProcessorLight).process(SocketWrapperBase<?>, SocketEvent) line: 66	
AbstractProtocol$ConnectionHandler<S>.process(SocketWrapperBase<S>, SocketEvent) line: 808	
NioEndpoint$SocketProcessor.doRun() line: 1498	
NioEndpoint$SocketProcessor(SocketProcessorBase<S>).run() line: 49	
ThreadPoolExecutor(ThreadPoolExecutor).runWorker(ThreadPoolExecutor$Worker) line: 1149	
ThreadPoolExecutor$Worker.run() line: 624	
TaskThread$WrappingRunnable.run() line: 61	
TaskThread(Thread).run() line: 748	

[stephanrauh]

Thanks for the kind words! BootsFaces is a leisure time project, so a little "thumbs up!" means a lot to us!

[stephanrauh]

These days I'm mostly occupied with another open source project of mine, but I must admit your bug looks interesting. I'm not sure I can reproduce it quickly. Would you mind to send us a reproducer? I.e. a small, minimal program showing the bug without requiring any configuration? In particular, no database?

Thanks in advance,
Stephan

[exabrial]

You're welcome :)

I forgot to mention the scenario why this is important: If you want to use bootsfaces on a page that's unauthenticated (like a login page), an attacker can run your server out of resources easy[ier] by creating millions of sessions. It's best to not let a public facing page modify the state of the server.

I'll get a reproducer to you tomorrow or wed, it's pretty easy to reproduce. Cheers,
-Jonathan

[exabrial]

Digging a little further Reading the Javadoc, I do think TomEE/MyFaces/OpenWebBeans is behaving correctly.

https://docs.oracle.com/javaee/7/api/javax/faces/component/UIViewRoot.html#getViewMap--

For reasons made clear in ViewScoped, this map must ultimately be stored in the session. For this reason, a true value for the create argument will force the session to be created with a call to ExternalContext.getSession(boolean)

So essentially, NavBar is forcing a session object to be created with this call:

BootsFaces-OSP/src/main/java/net/bootsfaces/listeners/AddResourcesListener.java

Line 896 in e4d4ba2

Map<String, String> resourceMap = (Map<String, String>) viewMap.get(resourceTypeKey);

[exabrial]

https://github.com/exabrial/bootsfaces-session-bug Here's a demo that shows session is always created on the stateless view

[stephanrauh]

As far as I can tell without running the program, you've delivered an awesome analysis, complete with a solution, and even a reproducer. We don't see that often. In return, I've put your issue + PR on the top of my "to do" list. Actually, I wanted to do it this evening, but I didn't manage to find enough spare time.

Regarding the reproducer: which application server to I need? Currently, I've installed a Liberty server and a Wildfly 17. Can I run the reproducer on one of them?

[exabrial]

It's a one stop shop. Simply clone it, then run mvn clean package tomee:run. After it starts visit: http://localhost:8080/bootsfaces-session-bug/index.jsf

[exabrial]

If you want to run it on another application server, you can mvn clean package then install the war in OpenLiberty or Wildfly or Glassfish.

[geopossachs]

Hello, I have used your example project @exabrial and take also a look for a solution. I think to store data in a static property of a Listener is not the best way for an enterprise application.

if I use root. attributes I can also switch off the session use but if I switch on the session in a bean, the Listener does not recognize this

@stephanrauh do we need to store the data into root.viewMap or can we use root.attributes as allternative

or with other words 'how can you determine whether you can start a session or not'?

https://github.com/geopossachs/BootsFaces-OSP/tree/issues/1117