Skip to content

Commit cd44efa

Browse files
Mohammad Saeed Nourisbrannen
Mohammad Saeed Nouri
authored andcommitted
Allow update of existing WebSession after max sessions limit is reached
Previously, when saving a WebSession, the system did not check whether the session ID already existed. As a result, even if the session being saved was an update to an existing one, it was incorrectly treated as a new session, and a "maximum sessions exceeded" error was triggered. This fix ensures that if a WebSession with the same ID already exists, it will be updated rather than counted as a new session, thereby preventing unnecessary session limit violations. See gh-35013 Closes gh-35018 Signed-off-by: Mohammad Saeed Nouri <[email protected]> (cherry picked from commit c04902f)
1 parent 59d2895 commit cd44efa

File tree

2 files changed

+21
-1
lines changed

2 files changed

+21
-1
lines changed

spring-web/src/main/java/org/springframework/web/server/session/InMemoryWebSessionStore.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@ public Mono<Void> save() {
280280
private void checkMaxSessionsLimit() {
281281
if (sessions.size() >= maxSessions) {
282282
expiredSessionChecker.removeExpiredSessions(clock.instant());
283-
if (sessions.size() >= maxSessions) {
283+
if (sessions.size() >= maxSessions && !sessions.containsKey(this.getId())) {
284284
throw new IllegalStateException("Max sessions limit reached: " + sessions.size());
285285
}
286286
}

spring-web/src/test/java/org/springframework/web/server/session/InMemoryWebSessionStoreTests.java

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323

2424
import org.junit.jupiter.api.Test;
2525
import reactor.core.scheduler.Schedulers;
26+
import reactor.test.StepVerifier;
2627

2728
import org.springframework.beans.DirectFieldAccessor;
2829
import org.springframework.web.server.WebSession;
@@ -157,6 +158,25 @@ void maxSessions() {
157158
.withMessage("Max sessions limit reached: 10");
158159
}
159160

161+
@Test
162+
void updateSession() {
163+
WebSession oneWebSession = insertSession();
164+
165+
StepVerifier.create(oneWebSession.save())
166+
.expectComplete()
167+
.verify();
168+
}
169+
170+
@Test
171+
void updateSession_whenMaxSessionsReached() {
172+
WebSession onceWebSession = insertSession();
173+
IntStream.range(1, 10000).forEach(i -> insertSession());
174+
175+
StepVerifier.create(onceWebSession.save())
176+
.expectComplete()
177+
.verify();
178+
}
179+
160180

161181
private WebSession insertSession() {
162182
WebSession session = this.store.createWebSession().block();

0 commit comments

Comments
 (0)