code flow that exhibits the race condition

SessionFixationProtectionRaceCondition.txt (text/plain), 3.83 KB, created by Christoph on 2013-09-04 10:24:05 UTC

(hide)

Description: code flow that exhibits the race condition

Filename:

MIME Type:

Creator: Christoph

Created: 2013-09-04 10:24:05 UTC

Size: 3.83 KB

patch

obsolete

>Thread A Thread B > >| | >session.invalidate() | >| | >+- StandardSession#invalidate() | > | | > +- StandardSession#expire() | > | | > +- StandardSession#expire(true) | > | | > if (expiring || !isValid) { } --> false | > | | > synchronized(this) { | > | | > ... | > | | > expiring = true; | > | | > ... (many things happening) session.invalidate() > | | > | +- StandardSession#invalidate() > | | > | StandardSession#expire() > | | > | +- StandardSession#expire(true) > | | > | if (expiring || !isValid) return; --> true > | | > | +-----+ > | | > | session = request.getSession(true) > | | > | +- ApplicationHttpRequest#getSession(true) > | | > | if (crossContext) { --> true > | | > | ... > | | > | if (session != null && session.isValid()) { --> true > | | > | return (session.getSession()); > | | > | } > | | > | } > | | > | +--+ > | | > | | // now session refers to the same object as befor an object in state "expiring" > setValid(false) | > | | > ... | > | | > expiring = false; | > | | > } // end of synchronization block | > | | // now session refers to an invalidated object >+--------+ | View Attachment As Raw

This is ASF Bugzilla: the Apache Software Foundation bug system. In case of problems with the functioning of ASF Bugzilla, please contact bugzilla-admin@apache.org. Please Note: this e-mail address is only for reporting problems with ASF Bugzilla. Mail about any other subject will be silently ignored.

• • Home
  • | New
  • | Browse
  • | Search
  • |
    [?]
  • | Reports
  • | Help
  • | New Account
  • | Log In
    Remember [x]
  • | Forgot Password
    Login: [x]