Tomcat - Prevent persistence of sessions

Question

I get an IOException while restarting tomcat. I tried various solutions as suggested in exception loading sessions from persistent storage

None of them solve the problem. I tried uncommenting the <Manager pathname=""/> in the context.xml. Didn't help.

Another solution suggested is to make the class implement Serialiable. I don't want to do that.

My aim is to make Tomcat not persist these sessions. I'm using Tomcat 7.0.54.

The following is the stack trace. Please help.

`SEVERE: IOException while loading persisted sessions:
     java.io.WriteAbortedException: writing aborted; java.io.NotSerializableException:     com.comp.cloud.portal.zCompHD
     java.io.WriteAbortedException: writing aborted; java.io.NotSerializableException: com.comp.cloud.portal.zCompHD
     at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1354)
     at java.io.ObjectInputStream.readObject(ObjectInputStream.java:370)
     at java.util.LinkedList.readObject(LinkedList.java:1136)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
     at java.lang.reflect.Method.invoke(Method.java:606)
     at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1017)
     at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1893)
     at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1798)
     at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
     at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:1990)
     at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1915)
     at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1798)
     at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
     at java.io.ObjectInputStream.readObject(ObjectInputStream.java:370)
     at java.util.HashMap.readObject(HashMap.java:1183)
     at sun.reflect.GeneratedMethodAccessor18.invoke(Unknown Source)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
     at java.lang.reflect.Method.invoke(Method.java:606)
     at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1017)
     at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1893)
     at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1798)
     at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
     at org.apache.catalina.session.StandardSession.readObject(StandardSession.java:1619)
     at org.apache.catalina.session.StandardSession.readObjectData(StandardSession.java:1084)
     at org.apache.catalina.session.StandardManager.doLoad(StandardManager.java:282)
     at org.apache.catalina.session.StandardManager.load(StandardManager.java:202)
     at org.apache.catalina.session.StandardManager.startInternal(StandardManager.java:489)
     at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
     at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5476)
     at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
     at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1559)
     at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1549)
     at java.util.concurrent.FutureTask.run(FutureTask.java:262)
     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
     at java.lang.Thread.run(Thread.java:744)

"... As documented above, every web application by default has standard manager implementation configured, and it performs session persistence across restarts. To disable this persistence feature, create a Context configuration file for your web application and add the following element there:..." - see http://tomcat.apache.org/tomcat-7.0-doc/config/manager.html#Disable_Session_Persistence — Leo, Jul 24 '14 at 05:00
@Leo : As stated in the description above, I tried doing that. Didn't help. What else can be done for this? — vplusplus, Jul 24 '14 at 05:17
Anyway - no matter if you want session persistence now - it's definitely bad idea to put non-serializable things to http session. It might be indicator of bad application design — Konstantin V. Salikhov, Jul 24 '14 at 05:24
@Konstantin: could you please explain why? Or, point me to resources that explain that. Thanks in advance. — vplusplus, Jul 24 '14 at 05:33
1) You may need clustering and session replication as your project grows, but you can't - your sessions are not serializable any more 2) Probably your non-serializable atrributes is attempt to inject something into multiple places that use that thing. Consider using DI and various design patterns for better readability and ease of future refactoring. Non-serializable sessions are known as J2EE antipattern. See this link for example: http://cwe.mitre.org/data/definitions/579.html — Konstantin V. Salikhov, Jul 24 '14 at 05:38
Java Servlet 3.0 specification states that in distributed environments (7.2.2) *The container must accept objects that implement the Serializable interface. The container may choose to support storage of other designated objects in the HttpSession, such as references to Enterprise JavaBeans components and transactions.* And some frameworks such as Apache MyFaces insists on serializing `Sessions`. — Serge Ballesta, Jul 24 '14 at 08:10

score 0 · Answer 1 · answered Dec 03 '17 at 06:23

An alternative approach to solving this issue could be to use Spring Session, which provides a replacement HttpSession object that can be persisted in a configurable way. A variety of persistence methods are available, e.g. Redis, JDBC, or an in-memory Map. By default they (or at least some of them) may expect the items to be serializable, but the implementation is much more customizable, so you could set a serializer that strips out your non-serializable objects and leaves the rest (for example).

Tomcat - Prevent persistence of sessions

1 Answers1