DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=12363>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=12363

StandardSession.setAttribute() does not conform to the servlet spec

[EMAIL PROTECTED] changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|INVALID                     |



------- Additional Comments From [EMAIL PROTECTED]  2004-03-16 21:20 -------
I think the right interpretation of the spec is the following:

1. get old attribute from context
2. remove old attribute from context
3. call valueUnbound() on old attribute
4. call valueBound() on new attribute
5. add the new attribute to the context

The way it is done now it calls valueUnbound() on the attribute after it is made
available through the context if you just rebind it - I highly doubt anybody
ever desired that.

The spec does say that step 3 should be executed after step 1 and 2; it also
says  that step 5 should be executed after 4. It never says that you should deal
with the old object after you finish with the new one. 

Here's what the spec says:

...
Some objects may require notification when they are placed into, or removed
from, a session. This information can be obtained by having the object implement
the HttpSessionBindingListener interface. This interface defines the following
methods that will signal an object being bound into, or being unbound from, a
session.
• valueBound
• valueUnbound
The valueBound method must be called before the object is made available via
the getAttribute method of the HttpSession interface. The valueUnbound
method must be called after the object is no longer available via the getAttribute
method of the HttpSession interface.
...
setAttribute(String, Object)
public void setAttribute(java.lang.String name,
java.lang.Object value)
Binds an object to this session, using the name specified. If an object of the
same name is already bound to the session, the object is replaced.
After this method executes, and if the new object implements HttpSession-
BindingListener, the container calls HttpSessionBinding-
Listener.valueBound. The container then notifies any
HttpSessionAttributeListeners in the web application.

If an object was already bound to this session of this name that implements
HttpSessionBindingListener, its HttpSessionBindingListener.value-
Unbound method is called.
If the value passed in is null, this has the same effect as calling remove-
Attribute().
...

Again, the spec does mention the old object after it mentions the new one but it
does not say it should only handle it after finishing with the new one. In fact,
you could argue that if an object is just rebound you should not call
valueUnbound() at all, after all, it was never unbound.

What happens now is that when Struts rebinds our session formbean the last
action performed on the bean is valueUnbound(). So after a successfull login our
session bean is told to mop up and go away. Needless to say you can no longer
use the application.

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to