JSF Multiple users cause ViewExpiredException

Question

I have built a simple login system for my JSF/Primefaces site using a sessionMap. In my main view, ParliamentManager which is a SessionScoped bean I have:

@PostConstruct
    public void postInit() {
      logger.log(Level.INFO,"Session started");
      ExternalContext externalContext = FacesContext.getCurrentInstance().getExternalContext();
      Map<String, Object> sessionMap = externalContext.getSessionMap();

      user = (User) sessionMap.get("user");
      logger.log(Level.INFO, "user trader is: {0}", 
              new Object[]{user.getTrader().getTraderId().toString()});
      userId = user.getUserId();

In my login view which is a RequestScoped ManagedBean I have:

public void login(ActionEvent event) {
    RequestContext requestContext = RequestContext.getCurrentInstance();
    FacesContext context = FacesContext.getCurrentInstance();
    boolean loggedIn = false;

    User user = request.findUser(username);
    if(user.getPassword().equals(this.getPassword()))
    {
        loggedIn = true;
        context.getExternalContext().invalidateSession();
        context.getExternalContext().getSession(true);
        context.getExternalContext().getSessionMap().put("user", user);
         logger.log(Level.INFO, "put user {0}", 
              new Object[]{user.getUserId()});
         logger.log(Level.INFO, "session id {0}", 
                  new Object[]{context.getExternalContext().getSessionId(false)});
        requestContext.addCallbackParam("loggedIn", loggedIn);
    }
}

In my login page I simply redirect to the main index page:

<script type="text/javascript">
function handleLoginRequest(xhr, status, args) {
    if(args.validationFailed || !args.loggedIn) {
        PF('dlg').jq.effect("shake", {times:5}, 100);
    }
    else {
        PF('dlg').hide();
        $('#loginLink').fadeOut();
        window.location = "http://localhost:8080/mysite/index.xhtml"
    }
}

This works ok if I have two users logged in (one in a browser session, another in an incognito session). However if I add a third user (another invognito session) I get a ViewExpiredException when submitting my ajax request within a form. I thought that I could have a large amount of sessions as I'd expect many users so I'm not clear on why I get the exception in these cirumstances. Am I associating the user and session incorrectly or could there be some other issue causing the exception?

Thanks, Zobbo

Are those two different "incognito" like one in chrome or one in firefox? Or both in the same browser incognito browser ? — Jorge Campos
Hi Jorge. They're all in the same browser (Chrome). So one "normal" tab, a new incognito window and another incognito window. Thanks. — zobbo
Chrome shares sessions across incognito instances, unfortunately. Use Firefox to do this. — Ingo Bürk

Ingo Bürk Ingo Bürk · Accepted Answer · 2016-10-11T06:17:40

In Chrome all incognito sessions share the same cookie jar. It's only destroyed once all incognito sessions are closed. This means that a second incognito session shares the cookies with the other incognito sessions. See [1].

You can either use a session in another browser or use a browser like Firefox with multiple private sessions as Firefox doesn't share cookies like that.

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=24690

JSF Multiple users cause ViewExpiredException

1 Answers