8

Could a session timeout happen if there are several very big files are uploaded? Imagine I upload one 5 GByte big file and a short session timeout is set. Could the session timeout occur during streaming the file?

BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555
opfau
  • 731
  • 9
  • 37

1 Answers1

9

Yes, it can. The servlet specification does nowhere forbid that a session could be destroyed during an active request. You'll thus risk a ViewExpiredException when such an upload arrives at bean.

If this is your concern, you've several options:

  1. Let the upload form asynchronously poll to the server at intervals to keep the session alive. You can in EL use #{session.maxInactiveInterval} to obtain the current timeout in seconds.

    <p:fileUpload ... />
<p:poll interval="#{session.maxInactiveInterval - 10}" async="true" />

    The 10 seconds difference is just to prevent that it arrives a few seconds too late because the page itself may also take some time to load all the HTML and to initialize the poll. You can if necessary conditionally start/render the poll on start of upload.

  2. Let the "onstart" event of upload increase the session timeout to a certain limit (hour?) and let the "oncomplete" event of upload put it back.

    <p:fileUpload ... onstart="increaseTimeout()" oncomplete="resetTimeout()" />
<p:remoteCommand name="increaseTimeout" listener="#{bean.increaseTimeout}" />
<p:remoteCommand name="resetTimeout" listener="#{bean.resetTimeout}" />

    You can in bean use ExternalContext#setSessionMaxInactiveInterval() to set the desired session timeout in seconds.

  3. Use a stateless JSF form. The view will never expire, regardless of how the HTTP session behaves.

    <f:view transient="true">
    ...
</f:view>

    Note: any view scoped beans tied to such a view will behave like request scoped ones. To avoid confusion, replace the annotations if necessary.

Community
  • 1
  • 1
BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555
  • Thanks a lot. I will use option 2 because the `p:fileUpload` is no more visible in my case when the upload is done. It is inside a dialog which will be closed and the upload is initiated via javascript call. – opfau Sep 25 '15 at 11:49
  • 1
    +1 for the mention of the stateless JSF form! :D didn't know that until now. in what jsf release will it be available? – Fritz Sep 25 '15 at 15:30
  • @Fritz: It's officially available since JSF 2.2, but in Mojarra it's been backported to 2.1.19. See also a.o. http://stackoverflow.com/q/3642919 – BalusC Sep 25 '15 at 15:36
  • The `p:fileUpload` `fileUploadListener` specified method is called for each file. So probably each call of this method resets the session time counter? Right? If a very big file is uploaded the requests of the file upload servlet does not reset the timeout counter? Right or not? – opfau Sep 28 '15 at 06:23
  • 1
    When using `multiple="true"`, the files are sent simultaneously, so `onstart` is called once. The files are processed individually, so `oncomplete` is called for each file. This would make option 2 a poor choice and option 1 a better choice. Nonetheless, option 1 is in any case most reliable as you never know beforehand how long an upload would take. Not sure what you mean with "file upload servlet" in context of this question. – BalusC Sep 28 '15 at 08:17
  • Yes option 1 sounds better. "file upload servlet" was wrong. It was a mistake when I thought about the FileUploadFilter. So the session counter is reset on each oncomplete, right? – opfau Sep 28 '15 at 10:51
  • 1
    When using option 2, yes. – BalusC Sep 28 '15 at 10:58
  • Option 1 is not working. The session expires (HttpSessionListener.sessionDestroyed is executed). Maybe I should post my solution in a new question? – opfau Sep 28 '15 at 12:09
  • I fixed the poll example, I overlooked the async bit. – BalusC Sep 28 '15 at 12:16
  • I added a `p:poll` listener method which is called, but the session expires anyway. – opfau Sep 28 '15 at 12:25
  • I added also a `Thread.sleep()` inside the upload handling method to exceed the session. – opfau Sep 28 '15 at 12:31
  • There was a `p:idleMonitor` somewhere in the code. After removing it, it works now. Unfortunately my "session expired" dialog is no more displayed when the session expired. – opfau Sep 29 '15 at 06:44
  • I think the `idleMonitor` has to be reset when the session time is extended. – opfau Sep 29 '15 at 14:08