Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>There is a big debate on whether the session attributes are cleared after controller exit.</p> <p>To clarify once and for all, we can look at the <strong>Spring MVC 3.1.0 RELEASE</strong> source code.</p> <p>The interface <strong><em>org.springframework.web.bind.support.SessionAttributeStore</em></strong> exposes the following methods:</p> <pre><code>void storeAttribute(WebRequest request, String attributeName, Object attributeValue); Object retrieveAttribute(WebRequest request, String attributeName); void cleanupAttribute(WebRequest request, String attributeName); </code></pre> <p>The default implementation is <strong><em>org.springframework.web.bind.support.DefaultSessionAttributeStore</em></strong></p> <p>By doing a "<em>Open Call Hierarchy</em>" on <em>cleanupAttribute()</em> in Eclipse, we can see that the method is called by 2 different flows:</p> <p>1) <strong><em>org.springframework.web.method.annotation.ModelFactory</em></strong></p> <pre><code>public void updateModel(NativeWebRequest request, ModelAndViewContainer mavContainer) throws Exception { if (mavContainer.getSessionStatus().isComplete()){ this.sessionAttributesHandler.cleanupAttributes(request); } else { this.sessionAttributesHandler.storeAttributes(request, mavContainer.getModel()); } if (!mavContainer.isRequestHandled()) { updateBindingResult(request, mavContainer.getModel()); } } </code></pre> <p>2) <strong><em>org.springframework.web.bind.annotation.support.HandlerMethodInvoker</em></strong></p> <pre><code>public final void updateModelAttributes(Object handler, Map&lt;String, Object&gt; mavModel, ExtendedModelMap implicitModel, NativeWebRequest webRequest) throws Exception { if (this.methodResolver.hasSessionAttributes() &amp;&amp; this.sessionStatus.isComplete()) { for (String attrName : this.methodResolver.getActualSessionAttributeNames()) { this.sessionAttributeStore.cleanupAttribute(webRequest, attrName); } } ... } </code></pre> <p>It is clear that in both cases, the session attribute is removed only when <em>this.sessionStatus.isComplete()</em> is called.</p> <p>I dug into the code of <strong><em>DefaultSessionAttributeStore</em></strong>. Under the hood, it gets the real <strong>HTTP Session</strong> object to store attributes, so they can potentially be accessed by other controllers in the same session.</p> <p><strong>So no, the session attributes are not removed after a clean POST.</strong></p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload