Spring-session: forward error cause two session(session,jsessionid)

[abincai]

config for error page

   @Bean
   public EmbeddedServletContainerCustomizer containerCustomizer() {
   return (container -> {
   ErrorPage error404Page = new ErrorPage(HttpStatus.NOT_FOUND, "/");
   container.addErrorPages(error404Page);
   });
   }

or

@Controller
@RequestMapping("/error")
public class CustomerErrorController implements ErrorController {
  @Override
  public String getErrorPath() {
    return "/error";
  }

  @RequestMapping(produces = "text/html")
  @ResponseStatus(code = HttpStatus.OK)
  public String errorHtml(HttpServletRequest request, HttpServletResponse response) {
    return "forward:/";
  }
}

cause two session. one create by spring-session,the other one create by jetty

log

···log
2016-08-31 21:34:10.896 DEBUG 301300 --- [qtp733693146-64] o.s.s.w.h.S.SESSION_LOGGER : A new session was created. To help you troubleshoot where the session was created we provided a StackTrace (this is not an error). You can prevent this from appearing by disabling DEBUG logging for org.springframework.session.web.http.SessionRepositoryFilter.SESSION_LOGGER

.......

2016-08-31 21:16:34.781 DEBUG 301300 --- [qtp733693146-17] org.eclipse.jetty.server.session : New session & id 13uxok8vr02jq1wftjfk2yq5rr 13uxok8vr02jq1wftjfk2yq5rr
2016-08-31 21:16:34.781 DEBUG 301300 --- [qtp733693146-17] org.eclipse.jetty.server.session : Session 13uxok8vr02jq1wftjfk2yq5rr maxInactiveInterval=1800
···

cookie

JSESSIONID:13uxok8vr02jq1wftjfk2yq5rr 
SESSION:c3c7c3a3-ea1d-49db-a1a2-3b1a524ef871

[rengx]

The same problem has occurred in my application.

config for error page in web.xml

<error-page>
    <error-code>404</error-code>
    <location>/jsp/404.jsp</location>
</error-page>

[onlyeat3]

I also encountered the same problem, in the absence of arguments, the default exception handler sendError(400,msg); jetty forwards the request to spring mvc, and the session object becomes jetty's

org.eclipse.jetty.server.session.HashedSession

The reason for this problem is

Public class SessionRepositoryFilter<S extends ExpiringSession>
Extends OncePerRequestFilter

Forward is not reprocessed by SessionRepositoryFilter

[vpavic]

How is the Spring Session SessionRepositoryFilter registered in your app? If you're using Spring Boot 1.5, this could be due to spring-projects/spring-boot#7467.

[onlyeat3]

@vpavic I have already solved this problem. The reason for this problem is not the direct spring-session generation. Instead, SpringMVC's DefaultHandlerExceptionResolver order is higher than what I define myself.The root cause is the following code.

protected ModelAndView handleMissingServletRequestParameter(MissingServletRequestParameterException ex, HttpServletRequest request, HttpServletResponse response, Object handler) throws IOException {
        response.sendError(400, ex.getMessage());
        return new ModelAndView();
    }

sendError throws the problem to jetty, jetty finds

<error-page>
<error-code>400</error-code>
<location>/error/400</location>
</error-page>

/error/400 is matched by the Spring MVC DispatcherServlet.
The request goes back to SessionRepositoryFilter. then....

[vpavic]

Thanks for following up @liuyuyu.

[rougou]

I had a similar problem in my app w/ embedded Tomcat. Just trying to access a page that doesn't exist resulted in an unwanted JSESSIONID cookie.
Had to call dispatcherServlet.setThrowExceptionIfNoHandlerFound(true); and handle NoHandlerFoundException myself, and then forward to /error manually. Would this be something that could be fixed on the Spring framework end?