tree e156913ec649adb03a33bde097f4f60307c18618
parent a39ed53e0f6ed95ff6c0e6de8dccf7ac5b8db849
author Luca Milanesio <luca.milanesio@gmail.com> 1693000491 +0100
committer Luca Milanesio <luca.milanesio@gmail.com> 1693128702 +0100

Fix HTTP session leaks during OAuth reauthentication

When an existing Gerrit session expires or the user
is signing out explicitly, the underlying HTTP session
remains active because of the JSESSIONID cookie being
preserved on the client. The situation was detected by
the OAuthWebFilter which was trying to resolve it by
invalidating the HTTP session explicitly.

By performing a detailed analysis of the HTTP sessions
and the GitHubLogin objects leaks, it is clear that
the explicit invalidation causes a "race" between the
client and the server where every single call creates
a new HTTP session object with a GitHubLogin associated
which would never be effectively used, because the
Gerrit login isn't completed and therefore the Gerrit
session is not finalised yet.

It is incorrect to expire the JSESSIONID if the
client still holds a cooking pointer to it, but the
existing session can be simply "cleaned up" by the
GitHub and Gerrit account information that aren't
known yet, so that no more objects are created and
leaked.

After the fix, there is exactly one GitHubLogin
object created per OAuth authentication phase vs.
tens of them which was the previous situation.

Bug: Issue 40015390
Change-Id: Ieff58fa48c9eb8cca6a90524fa616de9564767f5