| This bug has been found while investigating a flickering behaviour on NotificationsIT#simpleNotifications test. It's reproducing around 25% of the time when running the test: we simplified the original test to keep the setup of 2 users, then login with user1 perform a page creation, login with user2 perform notification set up, login with user1 and start creating pages. All operations are going through UI (no REST API used for creating pages) and to login users we use the standard form through TestUtils#login without performing a logout first. We added a check in the for loop for creating pages, ensuring that the value of the page is correct: 25% of the time the value is not correct as a CSRF token error occurs. It appeared when investigating on the bug that User1 is supposed to perform the page creation, and its token is properly cached when it's logged-in. However, we found that a few milliseconds after User1 logged in AJAX requests are triggered to the REST API for displaying icon and for getting notifications count: those requests, 25% of the time, are still using User2 credentials. To be more specific, it appeared that sometimes, the first request happening after User1 log-in, triggers a cookie authentification using User2 information. We also showed that the session invalidation method, and the method to replace cookie information were properly called when User1 is logged in. We even demonstrated that after calling the session invalidation method a new HttpSession was used, than the previous one, and when the request triggers a new cookie authentication, then it's again a new HttpSession. Here's an excerpt of the logs:
So there's apparently 2 different but probably linked bugs:
1. Somehow the HttpSession information seems to be wrongly reused, even if the session is supposed to be different according to its ID
2. for some reason, the cookie information is not invalidated properly since we log in again with User2 while it's now supposed to contain User1 information Note that apparently the bug only reproduced when using Firefox, where it appears 25% of the time in average, while on Chrome I didn't get a single failure in 20 runs. Also I obtained same failures and same information on both jetty and tomcat. |
