Bug 53460

Summary: Use error handling when TooManyActiveSessionsException happens in JSP
Product: Tomcat 7 Reporter: Konstantin Kolinko <knst.kolinko>
Component: JasperAssignee: Tomcat Developers Mailing List <dev>
Status: RESOLVED FIXED    
Severity: normal CC: patches
Priority: P2    
Version: 7.0.28   
Target Milestone: ---   
Hardware: PC   
OS: Windows XP   

Description Konstantin Kolinko 2012-06-23 14:02:41 UTC
I noticed this while testing the fix for bug 53230 in Tomcat 6.

To reproduce:
1. Limit the count of active sessions supported by session manager, by adding the following line to conf/server.xml:

<Manager maxActiveSessions="0" />

2. Start Tomcat and access the NumGuess example:

http://localhost:8080/examples/jsp/num/numguess.jsp


Actual result:
- Blank page.
- An error (SEVERE) is logged by JspFactoryImpl.internalGetPageContext(),
where this exception is swallowed.

Expected result:
- Error page.
- This expected issue does not deserve severe logging.

Note, that simply rethrowing it in JspFactoryImpl.internalGetPageContext() will not help, as will be further swallowed by Java code of JSP page and proper error handling there does not happen without a PageContext instance - see r1347100 for related fix.

Maybe create PageContext instance and initialize session in two separate calls? So that if session initialization fails, it could be handled by that PageContext instance.


Stack trace:
(trunk, running with SecurityManager enabled)
[[[
23-Jun-2012 17:28:20.937 SEVERE [http-apr-8080-exec-2] org.apache.jasper.runtime.JspFactoryImpl.internalGetPageContext Exception initializing page context
 org.apache.catalina.session.TooManyActiveSessionsException: createSession: Too many active sessions
	at org.apache.catalina.session.ManagerBase.createSession(ManagerBase.java:616)
	at org.apache.catalina.connector.Request.doGetSession(Request.java:2687)
	at org.apache.catalina.connector.Request.getSession(Request.java:2119)
	at org.apache.catalina.connector.RequestFacade$GetSessionPrivilegedAction.run(RequestFacade.java:217)
	at org.apache.catalina.connector.RequestFacade$GetSessionPrivilegedAction.run(RequestFacade.java:206)
	at java.security.AccessController.doPrivileged(Native Method)
	at org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:895)
	at org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:910)
	at org.apache.jasper.runtime.PageContextImpl._initialize(PageContextImpl.java:146)
	at org.apache.jasper.runtime.PageContextImpl.initialize(PageContextImpl.java:125)
	at org.apache.jasper.runtime.JspFactoryImpl.internalGetPageContext(JspFactoryImpl.java:112)
	at org.apache.jasper.runtime.JspFactoryImpl.access$000(JspFactoryImpl.java:41)
	at org.apache.jasper.runtime.JspFactoryImpl$PrivilegedGetPageContext.run(JspFactoryImpl.java:156)
	at org.apache.jasper.runtime.JspFactoryImpl$PrivilegedGetPageContext.run(JspFactoryImpl.java:129)
	at java.security.AccessController.doPrivileged(Native Method)
	at org.apache.jasper.runtime.JspFactoryImpl.getPageContext(JspFactoryImpl.java:63)
	at org.apache.jsp.jsp.num.numguess_jsp._jspService(numguess_jsp.java:54)

]]]
Comment 1 Mark Thomas 2012-06-26 13:58:54 UTC
I'm leaning towards:
- re-throwing the original exception if a PageContext can't be created
- modifying the generated JSP code so if no PageContext is present any error is wrapped in a ServletExcaption and re-thrown (rather than logged) so the container can handle it

This should ensure any problems creating the PageContext instance are clearly visible.
Comment 2 Mark Thomas 2012-06-26 20:09:50 UTC
Fixed in trunk and 7.0.x and will be included in 7.0.29 onwards.
Comment 3 patches 2012-08-30 14:01:30 UTC
Hi, 

Can you backport this patch to 6.0 ?

Bug 53230 was backport in 6.0.36 but it fix only servlet access, not jsp access as described in this bug.

Regards,