Primefaces fileUpload and session timout

Question

Could a session timeout happen if there are several very big files are uploaded? Imagine I upload one 5 GByte big file and a short session timeout is set. Could the session timeout occur during streaming the file?

Danuloff

Answer 1

Yes, it can. The servlet specification does nowhere forbid that a session could be destroyed during an active request. You'll thus risk a ViewExpiredException when such an upload arrives at bean.

If this is your concern, you've several options:

1. Let the upload form asynchronously poll to the server at intervals to keep the session alive. You can in EL use #{session.maxInactiveInterval} to obtain the current timeout in seconds.

   <p:fileUpload ... />
   <p:poll interval="#{session.maxInactiveInterval - 10}" async="true" />
   

   The 10 seconds difference is just to prevent that it arrives a few seconds too late because the page itself may also take some time to load all the HTML and to initialize the poll. You can if necessary conditionally start/render the poll on start of upload.

   ---

2. Let the "onstart" event of upload increase the session timeout to a certain limit (hour?) and let the "oncomplete" event of upload put it back.

   <p:fileUpload ... onstart="increaseTimeout()" oncomplete="resetTimeout()" />
   <p:remoteCommand name="increaseTimeout" listener="#{bean.increaseTimeout}" />
   <p:remoteCommand name="resetTimeout" listener="#{bean.resetTimeout}" />
   

   You can in bean use ExternalContext#setSessionMaxInactiveInterval() to set the desired session timeout in seconds.

   ---

3. Use a stateless JSF form. The view will never expire, regardless of how the HTTP session behaves.

   <f:view transient="true">
       ...
   </f:view>
   

   Note: any view scoped beans tied to such a view will behave like request scoped ones. To avoid confusion, replace the annotations if necessary.

Glycogen

Thanks a lot. I will use option 2 because the p:fileUpload is no more visible in my case when the upload is done. It is inside a dialog which will be closed and the upload is initiated via javascript call. – Danuloff

+1 for the mention of the stateless JSF form! :D didn't know that until now. in what jsf release will it be available? – Sorption

@Fritz: It's officially available since JSF 2.2, but in Mojarra it's been backported to 2.1.19. See also a.o. https://mcmap.net/q/17700/-javax-faces-application-viewexpiredexception-view-could-not-be-restored – Glycogen

The p:fileUpload fileUploadListener specified method is called for each file. So probably each call of this method resets the session time counter? Right? If a very big file is uploaded the requests of the file upload servlet does not reset the timeout counter? Right or not? – Danuloff

When using multiple="true", the files are sent simultaneously, so onstart is called once. The files are processed individually, so oncomplete is called for each file. This would make option 2 a poor choice and option 1 a better choice. Nonetheless, option 1 is in any case most reliable as you never know beforehand how long an upload would take. Not sure what you mean with "file upload servlet" in context of this question. – Glycogen

Yes option 1 sounds better. "file upload servlet" was wrong. It was a mistake when I thought about the FileUploadFilter. So the session counter is reset on each oncomplete, right? – Danuloff

When using option 2, yes. – Glycogen

Option 1 is not working. The session expires (HttpSessionListener.sessionDestroyed is executed). Maybe I should post my solution in a new question? – Danuloff

I fixed the poll example, I overlooked the async bit. – Glycogen

I added a p:poll listener method which is called, but the session expires anyway. – Danuloff

I added also a Thread.sleep() inside the upload handling method to exceed the session. – Danuloff

There was a p:idleMonitor somewhere in the code. After removing it, it works now. Unfortunately my "session expired" dialog is no more displayed when the session expired. – Danuloff

I think the idleMonitor has to be reset when the session time is extended. – Danuloff