avoiding session creation for unauthenticated users

These issues are now covered in ROL-1281:
http://opensource.atlassian.com/projects/roller/b
rowse/ROL-1281

I just committed the changes to trunk.

- Dave



On 10/21/06, Anil Gangolli <anilbusybuddha.org> wrote:
>
> CharEncodingFilter sets the request encoding as well. 
That part needs to
> stay and I think it should be mapped to /* as it
currently is.
>
> The proposal correctly excises the struts-related part.
 I'm +1 on it.
>
> --a.
>
> ----- Original Message -----
> From: "Allen Gilliland"
<allen.gillilandsun.com>
> To: <roller-devincubator.apache.org>
> Sent: Friday, October 20, 2006 2:10 PM
> Subject: Re: avoiding session creation for
unauthenticated users
>
>
> > +1 to all of these.
> >
> > In fact.  #1 from the CharEncodingFilter should
probably be pushed out
> > into its own filter since the CharEncodingFilter
is applied to /* which
> > affects all requests and that code is only
relevant to struts.  I would
> > think it'f more appropriate to put that in it's
own filter which is just
> > mapped to /roller-ui/*
> >
> > -- Allen
> >
> >
> > Dave wrote:
> >> Those all look like good and safe fixes to me.
> >>
> >> Anybody object to my making these changes in
the trunk?
> >>
> >> - Dave
> >>
> >>
> >> On 10/20/06, Robert Yates <robyates70gmail.com> wrote:
> >>> Hello,
> >>>
> >>> I work alongside Elias here at IBM.
> >>>
> >>> We have been recently experimenting with
Roller under heavy loads and
> >>> one of the first things we noticed was the
fairly heavy memory usage.
> >>> When we investigated this we found that
there were lots of Sessions
> >>> and RollerSessions on the heap even though
our load was a read only
> >>> load.
> >>>
> >>> I've gone through the code looking at the
areas that create sessions,
> >>> and found a few.  I list these below and
hope you'll consider these
> >>> fairly minor changes as something that
could be included in 3.1
> >>>
> >>> 1) CharEncodingFilter
> >>>
> >>> remove the following lines
> >>>
> >>>         // Keep JSTL and Struts Locale's
in sync
> >>>         // NOTE: The session here will get
created if it is not
> >>> present.  This code was taken from its
> >>>         // earlier incarnation in
RequestFilter, which also caused the
> >>> session to be created.
> >>>         HttpSession session =
((HttpServletRequest) req).getSession();
> >>>         if (mLogger.isDebugEnabled())
mLogger.debug("Synchronizing
> >>> JSTL and Struts locales");
> >>>         Locale locale = (Locale)
> >>> session.getAttribute(Globals.LOCALE_KEY);
> >>>         if (locale == null)
> >>>         {
> >>>             locale = req.getLocale();
> >>>         }
> >>>         if
(req.getParameter("locale") != null)
> >>>         {
> >>>             locale = new
Locale(req.getParameter("locale"));
> >>>         }
> >>>        
session.setAttribute(Globals.LOCALE_KEY, locale);
> >>>         Config.set(session,
Config.FMT_LOCALE, locale);
> >>>
> >>> given that ?locale= is now deprecated,
this code doesn't really do
> >>> anything.  If JSTL and Struts don't find
the session attribute (and in
> >>> JSTL's case attributes on the page or
request) then they will default
> >>> to the "req.getLocale()".  So
putting the value of req.getLocale()
> >>> into the struts and JSTL session
attributes is now redundant.
> >>>
> >>> 2) PageServlet, SearchServlet (and
possibly PreviewServlet,
> >>> PreviewServlet is not as important as
there will already be a session
> >>> for the logged in user).
> >>>
> >>> All these servlets make this call.
> >>>
> >>> PageContext pageContext =
JspFactory.getDefaultFactory().getPageContext(
> >>>                     this, request,
response,"", true, 8192, true);
> >>>
> >>> The third to last variable indicates
whether the session should be
> >>> created and it is currently set to
"true".
> >>>
> >>> Could we change the calls to
> >>>
> >>> PageContext pageContext =
JspFactory.getDefaultFactory().getPageContext(
> >>>                     this, request,
response,"", false, 8192, true);
> >>>
> >>> 3) Index.jsp
> >>>
> >>> Am not sure whether this is still a
problem. I just pulled the latest
> >>> build and I am not sure that it is still
called.  If it is still used
> >>> then could we add the following
"session" attribute to the page
> >>> directive which will cause the session to
not be created.
> >>>
> >>> <%
> >>> page
import="org.apache.roller.config.RollerRuntimeConfig&qu
ot;
> >>> session="false"%>
> >>>
> >>> Please let me know what you think,
> >>>
> >>> Thanks,
> >>>
> >>> Rob
> >>>
> >
>
>