cloudbase-ai opened a new pull request, #7897:
URL: https://github.com/apache/shenyu/pull/7897
Fixes #6314.
When a gateway filter accesses a WebSession, WebFlux can expire an incoming
`SESSION` identifier that is unknown to the gateway. If a backend uses the same
cookie name, that response deletes the backend's browser session.
Configure the packaged Bootstrap application to use `SHENYU_SESSION` through
Spring Boot's standard `server.reactive.session.cookie.name` property. Backend
cookies keep their original names, and Boot continues to manage cookie security
attributes and operator overrides. No dependencies or custom session beans are
added.
Add real loopback HTTP regression tests that load the actual Bootstrap YAML
and exercise Boot's session resolver with WebFlux. Remove Bootstrap's permanent
Surefire skip so these tests run according to the parent's `skipTests` setting;
copy the source YAML into test resources because the `release` profile excludes
it from the application JAR.
### Scope and upgrade compatibility
- This changes the current packaged Bootstrap configuration. Custom
launchers or deployments replacing that configuration must set the property
explicitly; the distribution already copies the same YAML into `conf`.
- Existing gateway logins using `SESSION` may need to authenticate again. An
explicit cookie-name override remains supported, including the legacy `SESSION`
name and its original collision risk.
- Document configuration, overrides, and migration in
`docs/gateway-session-cookies.md`. OAuth2 authorization rules are unchanged.
### Validation
- Before the configuration change: 5 regression tests ran, with 3 expected
failures reproducing backend-cookie deletion and shared gateway-cookie
creation/expiry.
- After the change: all 5 regression tests and the existing
`OAuth2PluginConfigurationTest` pass. The selected 145-module reactor passes
`verify`, including Checkstyle and Apache RAT.
- After cleaning Bootstrap's build output, the same 6 selected tests pass
with `-Prelease`; the YAML is present in test resources and excluded from main
resources as intended.
```sh
./mvnw -B -ntp -pl shenyu-bootstrap -am verify \
-Dtest=GatewaySessionCookieTest,OAuth2PluginConfigurationTest \
-Dsurefire.failIfNoSpecifiedTests=false \
-Djacoco.skip=true -Dmaven.javadoc.skip=true
./mvnw -B -ntp -pl shenyu-bootstrap clean
./mvnw -B -ntp -Prelease -pl shenyu-bootstrap -am test \
-Dtest=GatewaySessionCookieTest,OAuth2PluginConfigurationTest \
-Dsurefire.failIfNoSpecifiedTests=false \
-Djacoco.skip=true -Dmaven.javadoc.skip=true
```
Live CAS/OAuth2 provider login/logout and the full repository test suite
were not run.
Make sure that:
- [x] You have read the [contribution
guidelines](https://shenyu.apache.org/community/contributor-guide).
- [x] You submit test cases (unit or integration tests) that back your
changes.
- [ ] Your local test passed `./mvnw clean install
-Dmaven.javadoc.skip=true`. Targeted validation is listed above.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
