0050874: Timeout of Openbravo standard session is set to very low value if a request to a webservice is done using that session

Openbravo Issue Tracking System - Openbravo ERP

View Issue Details

Project

Category

View Status

Date Submitted

Last Update

0050874

Openbravo ERP

A. Platform

public

2022-11-14 10:00

2022-11-14 15:43

Reporter

AugustoMauch

Assigned To

AugustoMauch

Priority

normal

Severity

critical

Reproducibility

have not tried

Status

closed

Resolution

fixed

Platform

OS Version

Product Version

Target Version

PR22Q3.3

Fixed in Version

PR22Q3.3

Merge Request Status

approved

Review Assigned To

OBNetwork customer

Web browser

Modules

Core

Support ticket

Regression level

Regression date

Regression introduced in release

Regression introduced by commit

Triggers an Emergency Pack

Summary

0050874: Timeout of Openbravo standard session is set to very low value if a request to a webservice is done using that session

Description

In Openbravo there are at least two different session timeout configurations:
- For standard session the value defined in the session-timeout context parameter is used (default: 60 minutes) [1]
- For webservice sessions the timeout is defined to a much smaller value (default: 60 seconds) [2]

The problem is that within a standard Openbravo session a request is done to a webservice endpoint, the timeout of the standard session will be set to the timeout of webservice sessions (60 seconds). We should only do that if the session was created as a result of the the webservice request.

[1] https://gitlab.com/openbravo/product/openbravo/-/blob/master/src-db/database/sourcedata/AD_MODEL_OBJECT_PARA.xml#L255 [^]
[2] https://gitlab.com/openbravo/product/openbravo/-/blob/master/src/org/openbravo/service/web/BaseWebServiceServlet.java#L133 [^]

Steps To Reproduce

- Login in the Openbravo backoffice, i.e. https://livebuilds.openbravo.com/erp_pi_pgsql [^]
- Do not interact with the backoffice for two minutes and then try to open any window (i.e. Sales Order). This will work as expected because the timeout for standard sessions is longere
- Within that session make a request to a webservice (i.e. by entering this in the browser url input: https://livebuilds.openbravo.com/erp_pi_pgsql/org.openbravo.service.json.jsonrest/Country [^])
- Wait for a couple of minutes and try to open any window. You will not be able because the session will have expired

Proposed Solution

Additional Information