Project: Tomcat
Bug 51042 HttpSessionListener.sessionCreated() is called a second time when user is authenticated with no matching sessionDestroyed() call.
Reported: 2011-04-08 05:54:06 | Status: resolved fixed

When my web application has a HttpSessionListener configured in its web.xml, then that classes sessionCreated() is called when a user is assigned a new session. However, that method is *also* called when that user authenticates itself and the session is assigned a new ID (whether or not this is actually a "new session" can be disputed, but that's not the point of this bug). When the session is removed (due to a timeout, for example), then a single sessionDestroyed() call is executed. When the HttpSessionListener manages some kind of external resource, this behaviour leads to a resource leak, because sessionCreated() is called twice, while sessionRemoved() is only called once! I'm aware of the reason for changing the session ID and (somehow) understand why sessionCreated() is called again (after all there's a new session ID), but there must be *some* way for the SessionListener to be notified that the "old session" no longer exists. The same behaviour is seen in Tomcat 6.0 (and probably 5.5 as well, but I didn't test that).

Files changed in fix:
java/org/apache/catalina/Session.java java/org/apache/catalina/ha/session/DeltaManager.java java/org/apache/catalina/ha/session/DeltaSession.java java/org/apache/catalina/ha/session/JvmRouteBinderValve.java java/org/apache/catalina/manager/DummyProxySession.java java/org/apache/catalina/session/ManagerBase.java java/org/apache/catalina/session/StandardSession.java