Created attachment 1135254 [details] Simple web app for session counting Description of problem: If you start EAP with org.apache.catalina.session.StandardManager.MAX_ACTIVE_SESSIONS set and then create sessions in parallel, you can exceed this limit. How reproducible: 90% Steps to Reproduce: 1. Start EAP with: ./standalone.sh -Dorg.apache.catalina.session.StandardManager.MAX_ACTIVE_SESSIONS=3 2. Deploy attached application something.war 3. Connect to jboss-cli and check web resource status for something.war: /deployment=something.war/subsystem=web:read-resource(include-runtime=true) 4. Open more sessions than MAX_ACTIVE_SESSIONS (I tried it with 16) in parallel on URL: http://localhost:8080/something/SessionAccessCounter 5. Check web resource status again Actual results: There can be more active-sessions than you set with property MAX_ACTIVE_SESSIONS Expected results: All sessions over MAX_ACTIVE_SESSIONS limit are rejected
Created attachment 1135260 [details] Simple web app for session counting
It is a race condition in the StandardManager class when the session is created, the manager tries to calculate the number of active sessions https://source.jboss.org/browse/JBossWeb/branches/7.5.x/src/main/java/org/apache/catalina/session/StandardManager.java?hb=true#to295 and after that it creates the session adding it to the session map https://source.jboss.org/browse/JBossWeb/branches/7.5.x/src/main/java/org/apache/catalina/session/StandardManager.java?hb=true#to300 This is the cause of the race condition. this makes possible to create more sessions that the property MAX_ACTIVE_SESSIONS
Created attachment 1136458 [details] patch 7.5.x guarding the concurrent block for avoiding the race condition.