SEC-2980: Possible race condition in SessionRegistryImpl

[spring-projects-issues]

Selene Feigl (Migrated from SEC-2980) said:

Hello,

there is a possible race condition in SessionRegistryImpl when handling the principals map (principal -> session id)

• A principal P has one Session S1 in its set
• Thread A wants to add S2 to the same principal (calling registerNewSession)
• Thread A checks whether there is already a Set for principal P and gets a reference to the set containing S1
• Thread B wants to remove S1 (calling removeSessionInformation)
• Thread B obtains set from principal map and removes S1 from the Set
• Thread B checks wheter the Set is empty - it is - as Thread A did not add S2 yet - and removes it from the Map
• Thread A adds S2 to the non-referenced Set

Result: principals does not contain S2 as it should. If the session registry is used to limit number of sessions per user, the limit is not enforced. If a Spring application uses the SessionRegistry for other things, they won't work as expected. (listing all logged in users etc.)

[lrozenblyum]

To partially overcome this problem I wrapped it with a synchronized decorator as mentioned: #5775