Request parameter mixed up between users

[fender_rules]

I'm running 4 instances of JBoss-3.0.4 with AJP13 connector to loadbalance requests. Our customer complained about having their data (actually news article since it's a news portal site) changed by someone else, and after some investigation of access log I've found that request parameters of some requests are duplicated in another users request.

For example:

User B requests : /updateArticle.jsp?articleNumber=2
(forward to /updateArticle.do)

User A requests : /readArticle.do?articleNumber=1
User B requests : /updateArticle.do?articleNumber=1
(should have no request parameter at all since the value has been forwarded using POST method)

It only happens with some number of concurrent users, and I'm 100% sure it's not the application problem since log file reveals even request parameters are duplicated to even plain image files.

I've migrated our application to the latest JBoss-3.0.4_Tomcat-4.1.12 bundle and the problem has gone.

Could this be the Jetty problem? Any advise will be appreciated.

Thanks!

Xavier

[jox72]

I have the exact same problem. Please post if you find an answer to this.

I'm also using Jetty with JBoss....

[fender_rules]

I couldn't find the exact cause yet, but it seems JBoss-Tomcat bundle doesn't have this problem. Maybe I should post a bug report but first I'd like to know whether it's the Jetty or JBossWeb which causes the issue. Other problems I had encountered with JBossWeb + AJP13 are :

- Duplicated requests. Sometimes when I hit a web page with a firewall blocking all requests from others, I get a multiple request log at server side.
- Sometimes images are not shown correctly.
- If I follow a link from the outside (i.e. an email on mail client) to the website, all the static resources are not shown at all because of 404 File Not Found error. I've solved this problem by patching Jetty source code but not sure it's the ultimate solution or just a temporary workaround. It was because sometimes Jetty fails to recognize rewrited url with jsession id like - /images/test.gif;jsessionid=blahblah

Migrating to Tomcat solved most of the problem and introduced a few others :

- request.getRealPath always returns null. But this is a known issue.
- Occasionally, after some time after the startup all file creation attempts failed with IOException at Win32Filesystem.createFileExclusively(). I still don't get a clue about what causes the problem.

[gregwilkins]

The AJP13 listener in 3.0.4 has several bugs that are now fixed. The one you are seeing is the cached parameters are reused on later connections. The cache is now cleared in all circumstances.

There was also a problem with webapps that called setBufferSize on the response with a value larger than 8192

Both of these problems have been fixed and you can get an
fixed jbossweb.sar from http://sourceforge.net/project/showfiles.php?group_id=7322

[fender_rules]

Thanks for the answer greg, you made me regain faith in jbossweb :)