Giters

danieleteti / delphimvcframework

DMVCFramework (for short) is a popular and powerful framework for WEB API in Delphi. Supports RESTful and JSON-RPC WEB APIs development.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Session Code needs Tidy Up ?

fastbike opened this issue · comments

commented

Just looking at the session code I've noticed three things: the first two are minor code cleaning issues and the third may require a code change.

  1. TWebContext.SessionStop has a Boolean param "ARaiseExceptionIfExpired" that is not used in the method.
    IMO this can be removed

  2. TMVCEngine.GetCurrentSession has an Integer param "ASessionTimeout" hat is not used in the method.
    IMO this can be removed

  3. TWebContext.SessionStop removes the session from the global session dictionary.
    In certain circumstances this (via the TDictionary notification process) this can call the destructor on the Context's TWebSession instance. However the private variable is now left dangling so the next time it is accessed it will cause an AV.
    This require some more work to provide a reproducible example

commented

I think the fix is as simple as replacing
SId := TMVCEngine.ExtractSessionIdFromWebRequest(FRequest.RawWebRequest);
GlobalSessionList.Remove(SId);

with
SId := SessionId
GlobalSessionList.Remove(SId);
if SId <> '' then
FWebSession := nil;

This ensures if there is an active session then that session id will be used, otherwise it will look in the request cookies

commented

Thank you David, now it should be fixed.