Create HTTP sessions only for WebSocket handshakes

RequestListener created an HTTP session for every request, including
/caget, /healthcheck and static files, only to pass the remote address
to the WebSocket handshake. A client without cookies, such as a script
or a health probe, got a new session on every request, each kept for
the 30 minute session timeout. Enough requests exhausted the heap.

RequestListener now creates the session only when the Upgrade header
asks for a WebSocket. The JSP pages don't use sessions and no longer
create them (session="false"). AuditServerEndpointConfigurator copes
with a handshake that has no session.

Fixes #44

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: 2 people

src/integration/java/org/jlab/epics2web/HttpSessionTest.java

@@ -0,0 +1,87 @@
+package org.jlab.epics2web;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertNotNull;
+
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.net.http.WebSocket;
+import java.util.List;
+import java.util.UUID;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import org.junit.Test;
+
+/**
+ * Tests that only WebSocket handshakes create HTTP sessions (#44): a session per request kept
+ * clients without cookies, such as scripts, from being cheap to serve.
+ */
+public class HttpSessionTest {
+
+  private static final HttpClient HTTP = HttpClient.newHttpClient();
+
+  @Test
+  public void requestsDoNotCreateSessions() throws Exception {
+    for (String path :
+        List.of(
+            "caget?pv=channel1",
+            "healthcheck",
+            "console",
+            "test-camonitor",
+            "resources/js/epics2web.js")) {
+      HttpResponse<String> response = get(path);
+
+      assertEquals(path, 200, response.statusCode());
+      assertEquals(path + " set a cookie", List.of(), response.headers().allValues("Set-Cookie"));
+    }
+  }
+
+  /** The handshake's session carries the client's address to the endpoint, for the console. */
+  @Test
+  public void consoleShowsWebSocketClientAddress() throws Exception {
+    String name = "session-test-" + UUID.randomUUID();
+    WebSocket socket =
+        HTTP.newWebSocketBuilder()
+            .buildAsync(
+                URI.create("ws://localhost:8080/epics2web/monitor?clientName=" + name),
+                new WebSocket.Listener() {})
+            .join();
+
+    try {
+      String address = consoleAddressOf(name);
+      assertNotNull("Client not on the console", address);
+      assertNotEquals("Client address unknown", "Unknown", address);
+    } finally {
+      socket.abort();
+    }
+  }
+
+  /**
+   * Waits for the console to list the client, and returns its address, or null if it never does.
+   */
+  private static String consoleAddressOf(String name) throws Exception {
+    // Row cells: ID, IP, agent, name. The server may list the client just after the handshake.
+    Pattern row =
+        Pattern.compile("<td>[^<]*</td>\\s*<td>([^<]*)</td>\\s*<td>[^<]*</td>\\s*<td>" + name);
+    long deadline = System.currentTimeMillis() + 5_000;
+    while (true) {
+      Matcher matcher = row.matcher(get("console").body());
+      if (matcher.find()) {
+        return matcher.group(1);
+      }
+      if (System.currentTimeMillis() > deadline) {
+        return null;
+      }
+      Thread.sleep(100);
+    }
+  }
+
+  private static HttpResponse<String> get(String path) throws Exception {
+    return HTTP.send(
+        HttpRequest.newBuilder().uri(URI.create("http://localhost:8080/epics2web/" + path)).build(),
+        HttpResponse.BodyHandlers.ofString());
+  }
+}

src/main/java/org/jlab/epics2web/websocket/AuditServerEndpointConfigurator.java

@@ -20,8 +20,8 @@ public void modifyHandshake(
       ServerEndpointConfig config, HandshakeRequest request, HandshakeResponse response) {
 
     Map<String, List<String>> headers = request.getHeaders();
-    String remoteAddr =
-        (String) ((HttpSession) request.getHttpSession()).getAttribute("remoteAddr");
+    HttpSession session = (HttpSession) request.getHttpSession();
+    String remoteAddr = session == null ? null : (String) session.getAttribute("remoteAddr");
 
     // We don't use config.getUserProperties.add because it isn't one-to-one with a web socket
     // connection

src/main/java/org/jlab/epics2web/websocket/RequestListener.java

@@ -5,11 +5,15 @@
 import jakarta.servlet.annotation.WebListener;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpSession;
+import java.util.Locale;
 
 /**
- * Stores the remote address in the user's session. This is necessary since the Java web socket API
- * does not expose the remote address. Note: some implementations do (Tomcat does not, GlassFish
- * does).
+ * Stores the remote address in the user's session for WebSocket handshakes. This is necessary since
+ * the Java web socket API does not expose the remote address. Note: some implementations do (Tomcat
+ * does not, GlassFish does).
+ *
+ * <p>Only handshakes get a session: a session for every request would keep one per request, for the
+ * session timeout, for clients without cookies such as scripts and health probes.
  *
  * @author slominskir
  */
@@ -23,8 +27,15 @@ public void requestDestroyed(ServletRequestEvent sre) {}
   public void requestInitialized(ServletRequestEvent sre) {
     HttpServletRequest request = (HttpServletRequest) sre.getServletRequest();
 
-    HttpSession session = request.getSession();
+    if (isWebSocketHandshake(request)) {
+      HttpSession session = request.getSession();
+
+      session.setAttribute("remoteAddr", request.getRemoteAddr());
+    }
+  }
 
-    session.setAttribute("remoteAddr", request.getRemoteAddr());
+  static boolean isWebSocketHandshake(HttpServletRequest request) {
+    String upgrade = request.getHeader("Upgrade");
+    return upgrade != null && upgrade.toLowerCase(Locale.ROOT).contains("websocket");
   }
 }

src/main/webapp/WEB-INF/views/console.jsp

@@ -1,4 +1,4 @@
-<%@page contentType="text/html" pageEncoding="UTF-8"%>
+<%@page contentType="text/html" pageEncoding="UTF-8" session="false"%>
 <%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
 <%@taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt"%> 
 <!DOCTYPE html>

src/main/webapp/WEB-INF/views/overview.jsp

@@ -1,4 +1,4 @@
-<%@page contentType="text/html" pageEncoding="UTF-8"%>
+<%@page contentType="text/html" pageEncoding="UTF-8" session="false"%>
 <!DOCTYPE html>
 <html>
     <head>

src/main/webapp/WEB-INF/views/test-caget.jsp

@@ -1,4 +1,4 @@
-<%@page contentType="text/html" pageEncoding="UTF-8"%>
+<%@page contentType="text/html" pageEncoding="UTF-8" session="false"%>
 <!DOCTYPE html>
 <html>
     <head>

src/main/webapp/WEB-INF/views/test-camonitor.jsp

@@ -1,4 +1,4 @@
-<%@page contentType="text/html" pageEncoding="UTF-8"%>
+<%@page contentType="text/html" pageEncoding="UTF-8" session="false"%>
 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 <%@taglib prefix="app" uri="http://jlab.org/app/functions"%>
 <!DOCTYPE html>

src/test/java/org/jlab/epics2web/websocket/RequestListenerTest.java

@@ -0,0 +1,100 @@
+package org.jlab.epics2web.websocket;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletRequestEvent;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpSession;
+import java.lang.reflect.Proxy;
+import java.util.HashMap;
+import java.util.Map;
+import org.junit.Test;
+
+public class RequestListenerTest {
+
+  /** Session attributes, or null if no session was created. */
+  private Map<String, Object> session;
+
+  @Test
+  public void webSocketHandshakeGetsSessionWithRemoteAddress() {
+    requestInitialized("websocket");
+
+    assertEquals(Map.of("remoteAddr", "10.0.0.1"), session);
+  }
+
+  @Test
+  public void upgradeHeaderIsCaseInsensitive() {
+    requestInitialized("WebSocket");
+
+    assertEquals("10.0.0.1", session.get("remoteAddr"));
+  }
+
+  /** Other requests, such as /caget from a script without cookies, must not create sessions. */
+  @Test
+  public void otherRequestsGetNoSession() {
+    requestInitialized(null);
+    assertNull(session);
+
+    requestInitialized("h2c");
+    assertNull(session);
+  }
+
+  private void requestInitialized(String upgradeHeader) {
+    session = null;
+    HttpSession httpSession =
+        proxy(
+            HttpSession.class,
+            (method, args) -> {
+              if (method.equals("setAttribute")) {
+                session.put((String) args[0], args[1]);
+                return null;
+              }
+              throw new UnsupportedOperationException(method);
+            });
+    HttpServletRequest request =
+        proxy(
+            HttpServletRequest.class,
+            (method, args) ->
+                switch (method) {
+                  case "getHeader" ->
+                      "Upgrade".equalsIgnoreCase((String) args[0]) ? upgradeHeader : null;
+                  case "getRemoteAddr" -> "10.0.0.1";
+                  case "getSession" -> {
+                    if (session == null) {
+                      session = new HashMap<>();
+                    }
+                    yield httpSession;
+                  }
+                  default -> throw new UnsupportedOperationException(method);
+                });
+    ServletContext context =
+        proxy(
+            ServletContext.class,
+            (method, args) -> {
+              throw new UnsupportedOperationException(method);
+            });
+
+    new RequestListener().requestInitialized(new ServletRequestEvent(context, request));
+  }
+
+  private interface Handler {
+    Object handle(String method, Object[] args);
+  }
+
+  @SuppressWarnings("unchecked")
+  private static <T> T proxy(Class<T> type, Handler handler) {
+    return (T)
+        Proxy.newProxyInstance(
+            type.getClassLoader(),
+            new Class<?>[] {type},
+            (p, method, args) ->
+                switch (method.getName()) {
+                  case "hashCode" -> System.identityHashCode(p);
+                  case "equals" -> p == args[0];
+                  case "toString" -> type.getSimpleName();
+                  default -> handler.handle(method.getName(), args);
+                });
+  }
+}