Skip to content

Avoid creating sessions during invalidate - #15813

Merged
jamesfredley merged 1 commit into
8.0.xfrom
fix/session-invalidate-hardening
Jul 4, 2026
Merged

Avoid creating sessions during invalidate#15813
jamesfredley merged 1 commit into
8.0.xfrom
fix/session-invalidate-hardening

Conversation

@jamesfredley

Copy link
Copy Markdown
Contributor

Summary

  • Avoid creating a servlet session when GrailsHttpSession.invalidate() is called without an existing session
  • Preserve invalidated-wrapper semantics when an existing request session is invalidated before wrapper access
  • Add GrailsHttpSessionSpec regression coverage

Verification

  • .\\gradlew.bat --no-daemon --no-parallel --max-workers=1 :grails-web-common:test --tests "grails.web.servlet.mvc.GrailsHttpSessionSpec"
  • Review gate: Oracle GREEN and Codex GREEN for diff hash 81bc27b564a1b4dc3e0d900a1d56aaae6519941b

Notes

  • Full aggregate gate was attempted sequentially but aborted after unrelated Gradle worker connection resets and a stale/corrupt XML report from an unrelated Hibernate module. The focused affected-module spec passed after clearing that stale artifact.

Update GrailsHttpSession.invalidate() so it invalidates an existing servlet session without creating one when none exists. Add regression coverage for both no-session and existing-session wrapper paths.

Assisted-by: Hephaestus:gpt-5.5 review-gate codex-review
Copilot AI review requested due to automatic review settings July 2, 2026 19:13

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adjusts GrailsHttpSession.invalidate() so it no longer forces creation of a servlet HttpSession when none exists, while still ensuring that an already-existing request session can be invalidated even if the wrapper was never accessed. This aligns invalidation behavior with “don’t create on invalidate” expectations and adds a regression spec in grails-web-common to prevent regressions.

Changes:

  • Update GrailsHttpSession.invalidate() to use request.getSession(false) (no-create) and only invalidate when a session actually exists.
  • Ensure wrapper invalidation semantics remain consistent when an existing request session is invalidated before any wrapper access.
  • Add GrailsHttpSessionSpec coverage for both “no existing session” and “existing session” invalidation paths.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
grails-web-common/src/main/groovy/grails/web/servlet/mvc/GrailsHttpSession.java Stops invalidate() from creating a servlet session; invalidates only if an existing session is present (wrapper or request).
grails-web-common/src/test/groovy/grails/web/servlet/mvc/GrailsHttpSessionSpec.groovy Adds regression tests validating non-creation on invalidate and correct invalidation behavior when a request session already exists.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@testlens-app

testlens-app Bot commented Jul 2, 2026

Copy link
Copy Markdown

🚨 TestLens detected 1 failed test 🚨

Here is what you can do:

  1. Inspect the test failures carefully.
  2. If you are convinced that some of the tests are flaky, you can mute them below.
  3. Finally, trigger a rerun by checking the rerun checkbox.

Test Summary

CI / Functional Tests (Java 21, indy=true) > :grails-test-examples-app1:integrationTest

Test Runs
ForwardingSpec > Test forwarding to an action which returns a Map

🏷️ Commit: a812020
▶️ Tests: 42524 executed
⚪️ Checks: 45/45 completed

Test Failures

ForwardingSpec > Test forwarding to an action which returns a Map (:grails-test-examples-app1:integrationTest in CI / Functional Tests (Java 21, indy=true))
Condition not satisfied:

$('li', text: 'Jeff')
|
[]

	at functionaltests.ForwardingSpec.$tt__$spock_feature_1_5(ForwardingSpec.groovy:74)
	at functionaltests.ForwardingSpec.Test forwarding to an action which returns a Map_closure6(ForwardingSpec.groovy)
	at grails.gorm.transactions.GrailsTransactionTemplate$1.doInTransaction(GrailsTransactionTemplate.groovy:72)
	at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:137)
	at grails.gorm.transactions.GrailsTransactionTemplate.executeAndRollback(GrailsTransactionTemplate.groovy:69)
	at functionaltests.ForwardingSpec.Test forwarding to an action which returns a Map(ForwardingSpec.groovy)

Muted Tests

Select tests to mute in this pull request:

  • ForwardingSpec > Test forwarding to an action which returns a Map

Reuse successful test results:

  • ♻️ Only rerun the tests that failed or were muted before

Click the checkbox to trigger a rerun:

  • Rerun jobs

Learn more about TestLens at testlens.app.

@codecov

codecov Bot commented Jul 2, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 80.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 49.4912%. Comparing base (66cd24c) to head (a812020).

Files with missing lines Patch % Lines
...oovy/grails/web/servlet/mvc/GrailsHttpSession.java 80.0000% 0 Missing and 1 partial ⚠️
Additional details and impacted files

Impacted file tree graph

@@                Coverage Diff                 @@
##                8.0.x     #15813        +/-   ##
==================================================
+ Coverage     49.4842%   49.4912%   +0.0070%     
- Complexity      16697      16701         +4     
==================================================
  Files            1947       1947                
  Lines           92474      92477         +3     
  Branches        16152      16154         +2     
==================================================
+ Hits            45760      45768         +8     
+ Misses          39606      39602         -4     
+ Partials         7108       7107         -1     
Files with missing lines Coverage Δ
...oovy/grails/web/servlet/mvc/GrailsHttpSession.java 31.2500% <80.0000%> (+9.9385%) ⬆️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@jamesfredley
jamesfredley merged commit c88070e into 8.0.x Jul 4, 2026
47 of 48 checks passed
@jamesfredley
jamesfredley deleted the fix/session-invalidate-hardening branch July 4, 2026 14:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants