Error: Cannot create a session after response has been committed

Chris Gray

Ever since upgrading to JIRA 7.1.1 (Server), we have had users periodically getting 500 errors when they attempt to perform actions. The error in the logs is both "IllegalStateException: Cannot create a session after the response has been committed" and " Exception occurred after HTTP response was already committed: Cannot create a session after the response has been committed".  I think that this is related to users leaving tabs open on their machines overnight, and being logged out - thus losing the session.  Once a user has refreshed a window and re-logged in, the errors seem to go away, but this is elusive enough that I cannot be sure.  Has anyone seen anything similar to this?  Is this simply a case of idle users being logged out?

 

Thanks in advance

crf

Well, I can explain what the error message means, but I'm not sure how much help that will be.

HTTP is a fairly strict protocol. The client sends a request, which takes the form something like this:

GET /url HTTP/1.1
Header: Value
Header: Value
 
Payload

 

Similarly, responses always take the same form, which looks similar:

200 OK
Header: Value
Header: Value
 
Payload

 

The servlet API includes a mechanism for creating a "session" to associate with the user. The way it does this is to set a cookie for the client. On future requests, they are expected to give you back the same cookie so that you can find the session data again. However, the way that you set a cookie is by specifying it in a header. The error message means that the code tried to use the HTTP session for the first time at some point after the blank like that separates the response code and headers from the message payload. By this point it is too late because we're already sending the response; we can't go back in time and add another header to what was already "committed" to the client, so there is no way to honour the request to establish a new session.  Therefore, well... ka-boom!

Do you have a custom Seraph Authenticator installed?  My wild guess at a potential cause, based on your description, is that it may not handle timed out user sessions gracefully and that during the tap dance of trying to tell the user they need to re-authenticate, it hits an exception instead. Authenticators are deep enough in the guts of the page handling that I wouldn't be surprised if brokenness in them leads to this sort of thing.