[GH-2284] fix commitSession() called multiple times in requestDispatcher.include

Author: Laurent SCHOELENS

spring-session-core/src/main/java/org/springframework/session/web/http/SessionRepositoryFilter.java

@@ -205,6 +205,8 @@ private final class SessionRepositoryRequestWrapper extends HttpServletRequestWr
 
 		private boolean requestedSessionInvalidated;
 
+		private boolean hasCommitedInInclude;
+
 		private SessionRepositoryRequestWrapper(HttpServletRequest request, HttpServletResponse response) {
 			super(request);
 			this.response = response;
@@ -338,7 +340,7 @@ public String getRequestedSessionId() {
 		@Override
 		public RequestDispatcher getRequestDispatcher(String path) {
 			RequestDispatcher requestDispatcher = super.getRequestDispatcher(path);
-			return new SessionCommittingRequestDispatcher(requestDispatcher);
+			return new SessionCommittingRequestDispatcher(requestDispatcher, this);
 		}
 
 		private S getRequestedSession() {
@@ -397,8 +399,11 @@ private final class SessionCommittingRequestDispatcher implements RequestDispatc
 
 			private final RequestDispatcher delegate;
 
-			SessionCommittingRequestDispatcher(RequestDispatcher delegate) {
+			private final SessionRepositoryRequestWrapper wrapper;
+
+			SessionCommittingRequestDispatcher(RequestDispatcher delegate, SessionRepositoryRequestWrapper wrapper) {
 				this.delegate = delegate;
+				this.wrapper = wrapper;
 			}
 
 			@Override
@@ -408,7 +413,10 @@ public void forward(ServletRequest request, ServletResponse response) throws Ser
 
 			@Override
 			public void include(ServletRequest request, ServletResponse response) throws ServletException, IOException {
-				SessionRepositoryRequestWrapper.this.commitSession();
+				if (!this.wrapper.hasCommitedInInclude) {
+					SessionRepositoryRequestWrapper.this.commitSession();
+					this.wrapper.hasCommitedInInclude = true;
+				}
 				this.delegate.include(request, response);
 			}
 

spring-session-core/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java

@@ -1320,6 +1320,32 @@ public void doFilter(HttpServletRequest wrappedRequest) {
 		assertThat(bindingListener.getCounter()).isEqualTo(1);
 	}
 
+	@Test // gh-2284
+	void doFilterIncludeCommitSessionOnce() throws Exception {
+		MapSession session = this.sessionRepository.createSession();
+		this.sessionRepository.save(session);
+		SessionRepository<MapSession> sessionRepository = spy(this.sessionRepository);
+		setSessionCookie(session.getId());
+		
+		given(sessionRepository.findById(session.getId())).willReturn(session);
+
+		this.filter = new SessionRepositoryFilter<>(sessionRepository);
+		
+		doFilter(new DoInFilter() {
+			@Override
+			public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse)
+					throws IOException, ServletException {
+				String id = wrappedRequest.getSession().getId();
+				wrappedRequest.getRequestDispatcher("/").include(wrappedRequest, wrappedResponse);
+				assertThat(SessionRepositoryFilterTests.this.sessionRepository.findById(id)).isNotNull();
+				wrappedRequest.getRequestDispatcher("/").include(wrappedRequest, wrappedResponse);
+				verify(sessionRepository).findById(session.getId());
+				verify(sessionRepository).save(session);
+				verifyNoMoreInteractions(sessionRepository);
+			}
+		});
+	}
+
 	// --- helper methods
 
 	private void assertNewSession() {