将tomcat 7.0.59升级到7.0.61：提交响应后无法创建会话

Question

We are upgrading from Tomcat 7.0.59 to 7.0.61 and getting following error.

This error occurs only when passing via Apache proxy (no SSL).

When calling the Tomcat context from the browser (without Apache proxy) it works without problems.

Has anyone experienced the same/similar problem ?

We did go through the changelog ( https://tomcat.apache.org/tomcat-7.0-doc/changelog.html ) but we could not find any change explaining this behavior in Tomcat 7.0.61

SEVERE: Servlet.service() for servlet [CaptchaServlet] in context with path [/cw] threw exception
java.lang.IllegalStateException: Cannot create a session after the response has been committed
    at org.apache.catalina.connector.Request.doGetSession(Request.java:3008)
    at org.apache.catalina.connector.Request.getSession(Request.java:2384)
    at org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:897)
    at org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:909)
    at be.servlet.CaptchaServlet.doGet(CaptchaServlet.java:127)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:624)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at org.apache.catalina.filters.ExpiresFilter.doFilter(ExpiresFilter.java:1175)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:423)
    at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:190)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611)
    at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:745)

The code concerned is:

    public void doGet(HttpServletRequest req, HttpServletResponse resp)
        throws ServletException, IOException {

    HttpSession session = req.getSession();

    Captcha captcha = getNumberCaptcha(_width, _height, 5, Color.black);

    session.setAttribute(NAME, captcha);

    resp.setHeader("Cache-Control", "private,no-cache,no-store");
    resp.setContentType("image/png");


    // See https://wiki.apache.org/tomcat/FAQ/KnownIssues#ImageIOIssues
    // Wrap insite MyImageIOOutputStream
    ImageIO.write(captcha.getImage(), "png", new MyImageIOOutputStream(resp.getOutputStream()));

    resp.getOutputStream().flush();
    resp.getOutputStream().close();

}

Before you start saying it is the ImageIO we did use the MyImageIOOutputStream as specified on the https://wiki.apache.org/tomcat/FAQ/KnownIssues#ImageIOIssues .

We even tried with loading an image from File into a byte array and sending the byte array in the resonse (so no making use of ImageIO), but the problem remains the same.

Answer 1

It is surprising to find that this error occurs in Tomcat 7.0.61 but not in 7.0.59. The error basically says that you are creating a session after the header of the HTTP response has been sent. This is a problem because the session requires cookies and the cookies are transferred in the HTTP response headers. So it's too late to send the cookies.

Assuming that the CaptchaServlet is your code, the easiest solution is to create the session ( getSession() ) before your write any output in the servlet. Then you are on the safe side with any servlet container.

Answer 2

I confirm that I have the same issue than you (in my particular case, 7.0.62 vs 7.0.59). My app works fine behind the apache proxy if Tomcat version is 7.0.59 but I have the same trace than you if I use 7.0.62 behind the proxy.

In my opinion we should report it to Tomcat as soon as possible