asked on

Lost sessions and / or lost session data in a site with Spring MVC/Security and Tomcat

The website I am supporting was developed with Spring MVC (4.2.9.RELEASE), Spring Security (3.2.5.RELEASE), JSP, and Hibernate (4.3.8.Final). The frontend is a load balancer (Kemp LoadMaster 3000) and the site runs on Tomcat (8.5.54). In order to find the cause of this issue, I am running only one Tomcat instance behind the load balancer in order to have a simpler system. Each page on the site (public pages and the pages seen after authentication) runs under HTTPS (The SSL certificate is installed on the load balancer, which sends HTTP requests to Tomcat). The server is Windows Server 2012 R2 Standard. There is no use of session.invalidate() in code.

The site has a multi-page form for the public (no authentication is needed). The following simplified code shows the issue (the multi-form uses the same JSP and controller methods)

----get----

@RequestMapping(value="/form", method = RequestMethod.GET)
public String pageGet(HttpServletRequest request, 
    HttpServletResponse response,
    Model model, Map<String, Object> map) throws IOException {

    request.getSession().setAttribute("token", "token-value");
    request.getSession().setAttribute("sessionId", request.getSession().getId());

    return "myform";
}

Open in new window

----jsp----

<form method="post" action="....">

<input type="hidden" name="sessionId" value="the value of session id from the get method"> 

...other fields

</form>

Open in new window

----post----

@RequestMapping(value="/form", method = RequestMethod.POST)
public String pageGet(HttpServletRequest request, 
    HttpServletResponse response,
    Model model, Map<String, Object> map) throws IOException {

    System.out.println(request.getSession().getAttribute("token"));
    System.out.println(request.getParameter("sessionId")); //session ID stored in form
    System.out.println(request.getSession().getId()); //current session ID

    return "redirect:/success";
}

Open in new window

The controller class has no class variables that store the token value or store session id shown in the code.

The session timeout on the load balancer is 60 minutes and its persistent mode is

Super HTTP and Source IP

Note that cache on the load balancer is disabled. The session timeout on Tomcat is also 60 minutes specified in web.xml

<session-config>
    <session-timeout>60</session-timeout>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

Open in new window

Here are my observations about the issue of lost sessions and/or session data. For a big percentage of the times, the POST method prints the same session IDs and token value if the submission takes place within 60 minutes after the form is displayed, and the multi-page form work just fine. This is understandable. What I don't understand is that for a small percentage of cases in which the form submission happens before the 60 minute limit, the session ID changes AND the token value is null or the session IDs remain the same BUT the token value is null. This issue could happen at any step of the form (that is, page 1, page 2, etc.)

I added a listener to get some info about when lost sessions are destroyed in the sessionDestroyed method.

long inactivePeriod = (new Date().getTime() - session.getLastAccessedTime())/1000;

The value is always a few seconds after 3600 sessions (an hour) such as 3602, 3604, etc. No exceptions.

The following is the related setup in Spring Security.

<security:http auto-config="false" use-expressions="true" request-matcher="regex" entry-point-ref="authenticationEntryPoint" >
    <security:intercept-url pattern="^\/secure\/.*$" access="hasRole('ROLE_USER')"  />
    <security:access-denied-handler ref="accessDeniedHandler" />
    <security:logout invalidate-session="true" logout-url="/secure/logout" logout-success-url="/" delete-cookies="JSESSIONID" />
    <security:custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER" />  
    <security:anonymous username="guest" granted-authority="ROLE_GUEST" />
</security:http>

Open in new window

This is the server.xml in Tomcat.

<Server port="dddd" shutdown="kkkkk">
  <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />

  <Service name="Catalina">

    <Connector URIEncoding="UTF-8" 
        compressableMimeType="text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json" 
        compression="on" 
        compressionMinSize="2048" 
        connectionTimeout="20000" 
        maxThreads="500" 
        maxConnections="30000" 
        noCompressionUserAgents="gozilla, traviata" 
        port="80" 
          maxHttpHeaderSize="10240" 
        protocol="org.apache.coyote.http11.Http11NioProtocol" 
        redirectPort="443"
        useSendfile="false"/> 

    <Engine name="Catalina" defaultHost="localhost">

        <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"
                 channelSendOptions="8">

          <Manager className="org.apache.catalina.ha.session.DeltaManager"
                   expireSessionsOnShutdown="false"
                   notifyListenersOnReplication="true"/>

          <Channel className="org.apache.catalina.tribes.group.GroupChannel">
            <Membership className="org.apache.catalina.tribes.membership.McastService"
                        address="224.0.0.252"
                        port="4001"
                        frequency="500"
                        dropTime="3000"/>
            <Receiver className="org.apache.catalina.tribes.transport.nio.NioReceiver"
                      address="auto"
                      port="4000"
                      autoBind="100"
                      selectorTimeout="5000"
                      maxThreads="250"
                      minThreads="6"/>

            <Sender className="org.apache.catalina.tribes.transport.ReplicationTransmitter">
              <Transport className="org.apache.catalina.tribes.transport.nio.PooledParallelSender"/>
            </Sender>
            <Interceptor className="org.apache.catalina.tribes.group.interceptors.TcpFailureDetector"/>
            <Interceptor className="org.apache.catalina.tribes.group.interceptors.MessageDispatchInterceptor"/>
          </Channel>

          <Valve className="org.apache.catalina.ha.tcp.ReplicationValve"
                 filter=""/>
          <Valve className="org.apache.catalina.ha.session.JvmRouteBinderValve"/>

          <ClusterListener className="org.apache.catalina.ha.session.ClusterSessionListener"/>
        </Cluster>        

    </Engine>
  </Service>
</Server>

Open in new window

How can I prevent the loss of sessions and/or session data if a session does not time out? I really need this because of how the site works. I spend a lot of time online for a possible fix and did MANY and VARIOUS tests (including adding code to exclude the possibility that the issue is caused by spam or attack), but no success.

Please feel free to let me know if you need more info about the site or tests.

-----6/19/20 Update ------

I have added screenshots to show the settings of the load balancer.

-----6/20/20 Update ------

The multi-page form has extra code to make sure Javascript and cookies are enabled. If Javascript or cookie is disabled in a browser, the form doesn't show form fields or the submit button.
Screenshot_2020-06-19-part1.png
Screenshot_2020-06-19-part2.png
RequestDumperFilter-catalina-2020070.txt
log-access-20200709.txt

girionis

Maybe the load balancer does not propagate the session correctly. Have you tried to remove the load balancer and stay only with tomncat?