lukaszraczylo/traefikoidc
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/traefikoidc.git synced 2026-10-14 04:07:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

R69: fix double pool-return on session-timeout path

Browse Source
This commit is contained in:
lukaszraczylo
2026-08-13 17:11:17 +01:00
parent d5fddebeaa
commit 6dbffcba40
2 changed files with 58 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
session.go
+7 -2
View File
@@ -1072,7 +1072,11 @@ func (sm *SessionManager) GetSession(r *http.Request) (*SessionData, error) {
// Check session timeout
if sessionData.getCreatedAtUnsafe() > 0 {
if time.Since(time.Unix(sessionData.getCreatedAtUnsafe(), 0)) > sm.sessionMaxAge {
_ = sessionData.Clear(r, nil) // Safe to ignore: session is being invalidated
// handleError returns the session to the pool and fully
// resets it; do NOT call Clear() here too, or the same
// pointer is pooled twice (two GetSession calls hand out
// one shared object -> data race / session bleed) and
// activeSessions is double-decremented.
return handleError(fmt.Errorf("session timeout"), "session expired")
}
}
@@ -1092,7 +1096,8 @@ func (sm *SessionManager) GetSession(r *http.Request) (*SessionData, error) {
if createdAt, ok := sessionData.mainSession.Values["created_at"].(int64); ok {
if time.Since(time.Unix(createdAt, 0)) > sm.sessionMaxAge {
_ = sessionData.Clear(r, nil) // Safe to ignore: session is being invalidated
// handleError returns the session to the pool and resets it;
// do not also call Clear() (double pool-put, see above).
return handleError(fmt.Errorf("session timeout"), "session expired")
}
}