Tomcat 持久管理器与 JDBC 存储访问 static 资源时抛出空指针异常

Question

We have been using multiple instances of tomcat (using spring boot) 9.x versions on multiple nodes, which handles static + dynamic resources. Intermittently, we have been seeing issues with session management and below given exceptions particularly when multiple static resources like css/js are being accessed from html files.

Aug 24 11:51:38 31f8d4f54c9a security [https-jsse-nio-4700-exec-24] 12e42fb1-c0ef-4717-aad9-cc61b5c40929 org.apache.catalina.core.ContainerBase.[Tomcat].[localhost] Exception Processing /security/images/logo.png
java.lang.NullPointerException: null
        at org.apache.catalina.session.StandardSession.doWriteObject(StandardSession.java:1641)
        at org.apache.catalina.session.StandardSession.writeObjectData(StandardSession.java:1065)
        at org.apache.catalina.session.JDBCStore.save(JDBCStore.java:804)
        at org.apache.catalina.valves.PersistentValve.invoke(PersistentValve.java:166)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:834)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.base/java.lang.Thread.run(Thread.java:829)

From different articles and forums (Reference: Why should Tomcat's PersistentValve not be used where there may be concurrent requests per session? ), it seems that Persistent Valve assumes that only single request is being sent from the session. This is highly unlikely with web applications that requires many css or js files to be rendered on a webpage.

What alternatives exist to manage and externalize this session without using JDBC Store or Persistent Valve? OR is there any workaround or a way to address this issue?

Please advise.

Answer 1

I had the same problem with Tomcat's PersistentValve and I managed to fix it using filter attribute to let Valve know which request really change session values. Requests for JS, HTML, CSS files or any static resources shouldn't change session so there's no need to change session in database. You can find example and description of this Valve here - https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#Persistent_Valve