fix: Prevent deadlock in findOrCreateVaadinSession (#12355)
It is possible findOrCreateVaadinSession leaves session locked if HTTP session is invalidated in an another thread between lockSession and unlockSession calls. This PR changes the implementation so that this can no longer happen.
fixes: #12352
fix: use time-constant comparison for CSRF tokens (#12188)
This hardens the framework against a theoretical timing attack based on
comparing how quickly a request with an invalid CSRF token is rejected.
Cherry-picked from: https://github.com/vaadin/flow/pull/9875
to allow for better integration of third party applications handling the destruction of the session.
Usage example (see https://vaadin.com/directory/component/cleanupservlet-add-on/overview)
"It's possible to close a browser window in such way that neither UI cleanup nor session cleanup will happen until the underlying http session timeouts. This can happen because the design idea for heartbeat is to keep the UI alive, not to ensure timely cleanup, and as such the default check is only performed at the end of each request."
Use APPLICATION_SCOPE for the session lock (#11792)
The Vaadin session itself is also stored in APPLICATION_SCOPE. The default
scope is PORTLET_SCOPE, so lock would be otherwise not be in sync with
the session.
To be able to do this, relevant methods in VaadinService are made protected so
that VaadinPortletService can override them.
Fixes #11611
Do full connector tracker cleanup when the session lock is released (#9707)
As there is no "request end" call after invoking UI.access() from a background thread,
the connector map was not earlier properly cleaned afterwards. If you toggled visibility of a
component from the background thread, the tracker state became inconsistent.
If this becomes a performance problem, it could probably be optimized to that cleanup
is done in request end and only at the end of access if not inside a request.
Fixes #9654
Add dependency filters through the service init event (#9368)
We shouldn't create new service loader interfaces since each new such
interface has implications for custom integrations. Instead, the
VaadinServiceInitListener mechanism should be enhanced to allow such
listeners to introduce their own dependency filter implementations
similarly to how VaadinServiceInitListener can already be used to
contribute new request handlers
Correct all tests that introspect classpath for Vaadin classes.
Fixes vaadin/framework8-issues#399
RemoveListenersDeprecatedTest test is fixed.
Corrections are made to make the test above passes.
Change-Id: I209a4693d241a1488b69b4742f48549dbf4bf0ac
Change addXXListener method in VaadinService to return Registration.
Fixes vaadin/framework8-issues#492
Old removeXXXListener methods are deprecated. New style of
unregistration is used.
Change-Id: If986dc9f8813ee7a5efc374a3facd5a8d23bc6a9
Move session store/load/remove logic to service from session (#9782, #18998)
The session storage logic when implemented in VaadinSession was and must be
partly static. This makes it impossible to override the storage logic.
To be able to support storage customizations for portals (storing using
APPLICATION_SCOPE), the logic was moved to VaadinService.
For portals, all storage operations now use APPLICATION_SCOPE. Previously
only the store operation was done using APPLICATION_SCOPE, leading to
some portals not being able to load the session at all (the default
scope for reading attributes in portals is PORTLET_SCOPE).
Change-Id: I3d112608d98c883a457e650c0a25bf10c81acc78
Tatu Lund
Anna Koskinen
Felix Fontein
Knoobie
Leif Åstrand
Ilia Motornyi
Teemu Suo-Anttila
Ahmed Ashour
Henri Sara
Dos Moonen
Artur
caalador
Denis
Per-Åke Minborg
Teemu Suo-Anttila
Markus Koivisto