NPE in SessionListener spring boot starter

[antonioa-lv]

Hello, in our spring application (using net.bull.javamelody:javamelody-spring-boot-starter:2.0.0) with embedded tomcat we are experiencing NullPointerExceptions on SessionLister#fixSessionsWithChangedId when it tries to store a session in the ConcurrentHashMap.

It happens because it's trying to store a null key. We have noticed the session object is blank, all the fields are set to default values and thus the id is null. It is likely happening because Tomcat is recycling the session objects (tomcat-embedded-core org.apache.catalina.valves.PersistentValve:174). Somehow the sessionListener never had a chance to remove that session object before the recycling of it.

Did anyone experience this issue? we are not sure if this a bug in melody or tomcat or our application

[evernat]

No answer here of anyone experiencing this issue and nothing similar in issues or in web search as far I know, so it seems that this issue is not common.

If you still have the issue, more information would be needed such as :

• version of spring-boot
• version of Tomcat
• anything specific related to sessions going on in the code of your application
• if you use spring-session or not and if yes, which version (spring-session had caused some issues in the past, so I prefer to ask)
• and probably a simple source of a project and a way to reproduce the issue