Re: [servlet-dev] WebSocket and HttpSession

[Manfred Riem <m_riem@xxxxxxxxxxx>]

Hi Mark,

Once the original request is upgraded that authentication should not be propagated by the Servlet layer.
If the developer wants to do something here, they should do that as part of the upgrade handler.

Which means for WebSocket the WebSocket folks should address this in the WebSocket specification if they choose to do so.

This does NOT belong to Servlet specification to solve.

Manfred

-----Original Message-----
From: servlet-dev <servlet-dev-bounces@xxxxxxxxxxx> On Behalf Of Mark Thomas
Sent: Thursday, June 8, 2023 12:44 PM
To: servlet-dev@xxxxxxxxxxx
Subject: Re: [servlet-dev] WebSocket and HttpSession

On 08/06/2023 17:10, Manfred Riem wrote:
> Hi Mark,
> 
> Once you do a protocol upgrade one should not try to use anything that had to do with the original Servlet request.
> 
> If someone wants 'session' management then they should implement that as part of their WebSocket application.

Ideally, yes. Unfortunately that breaks down if access to the WebSocket endpoint is authenticated as the original HTTP request is then authenticated and that authentication process is linked to the HTTP session.

There are lots of different strategies for handling this. I'm not advocating for any one strategy. I am aiming for the minimal change to the Servlet and/or WebSocket specs that would allow developers to implement their strategy of choice.

Mark


> 
> Anyway my 2 dollars (inflation and all)
> 
> Thanks!
> 
> Kind regards,
> Manfred Riem
> 
> -----Original Message-----
> From: servlet-dev <servlet-dev-bounces@xxxxxxxxxxx> On Behalf Of Mark 
> Thomas
> Sent: Thursday, June 8, 2023 10:58 AM
> To: servlet developer discussions <servlet-dev@xxxxxxxxxxx>
> Subject: [servlet-dev] WebSocket and HttpSession
> 
> Hi all,
> 
> I'd like to see if we can find a way to resolve a long standing WebSocket issue. The full detail can be found in this issue:
> https://github.com/jakartaee/websocket/issues/175
> 
> The short version is that a WebSocket session that retains a reference to the Servlet HttpSession in place when the WebSocket handshake took place needs a way to indicate that it is using the session and that the session should not be invalidated for inactivity.
> 
> My proposal is to add the following method to HttpSession:
> 
> public void access()
> 
> 
> Calling this method would update the last accessed time to the current time.
> 
> The circumstances in which a WebSocket application may call this method would be left as an application concern as different applications are likely to want to adopt different strategies.
> 
> Thoughts?
> 
> Mark
> _______________________________________________
> servlet-dev mailing list
> servlet-dev@xxxxxxxxxxx
> To unsubscribe from this list, visit 
> https://www.eclipse.org/mailman/listinfo/servlet-dev
> _______________________________________________
> servlet-dev mailing list
> servlet-dev@xxxxxxxxxxx
> To unsubscribe from this list, visit 
> https://www.eclipse.org/mailman/listinfo/servlet-dev
_______________________________________________
servlet-dev mailing list
servlet-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/servlet-dev