This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch feature/WW-3576-session-map-staleness in repository https://gitbox.apache.org/repos/asf/struts.git
commit aa6277d75631c9c7d3c5232cf6be3ade3b0abded Author: Lukasz Lenart <[email protected]> AuthorDate: Sun Oct 18 12:27:09 2026 +0200 WW-3576 docs: request end detaches every SessionMap built for the request Co-Authored-By: Claude Opus 5.5 <[email protected]> --- .../specs/2026-10-18-WW-3576-session-map-staleness-design.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/superpowers/specs/2026-10-18-WW-3576-session-map-staleness-design.md b/docs/superpowers/specs/2026-10-18-WW-3576-session-map-staleness-design.md index abf454b6c..2fc7a9de0 100644 --- a/docs/superpowers/specs/2026-10-18-WW-3576-session-map-staleness-design.md +++ b/docs/superpowers/specs/2026-10-18-WW-3576-session-map-staleness-design.md @@ -63,7 +63,9 @@ when that session dies (request threads), and one map that is stale *by design* (`null` / `false` / empty set / no-op). A later `put` obtains a session through `request.getSession(true)` — **only while the request is live**. - **Detached at request end (decided after the final review):** the request cleanup in the dispatcher - marks the request's `SessionMap` detached. A detached map never calls its request again: with a live + detaches every `SessionMap` built for that request (each registers itself on the request at + construction), not only the bound context's: this covers the original map left behind when + `createSession` replaces `ActionContext.SESSION`, and the maps of a nested forward. A detached map never calls its request again: with a live pinned session it keeps working (async `Callable`s, stored `SessionAware` fields); a `put` with no live pinned session throws `IllegalStateException`. Reason: a background thread (sandbox escape, custom `BackgroundProcess`) reaching `request.getSession(true)` after the request was recycled would write
