SessionScoped cdi bean injected in filter - not re-inject for different session?

Question

I have this issue, and I'm not sure if this is "expected" behaviour, but here is my problem:

I have a Http Filter:

@WebFilter(filterName = "VerificationFilter", urlPatterns = {"/activation/*"})
public class VerificationFilter implements Filter {
    private static final Logger logger = LoggerFactory.getLogger(VerificationFilter.class);
    private static final String ACTIVATION_CODE_PARAM_KEY = "vc";
    @Inject
    private UserInfo userInfo;
    @Inject
    private ActivationInfo activationInfo;
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        logger.debug("************VerificatoniFilter initializing*************");
    }

    /**
     * This filter filters requests by path - anything in the /activate/ namespace will
     * be filtered to first determine if the user has already passed through this filter once.
     * If the user has been "filtered" and the validation code was deemed to be valid, navigation will
     * be permitted to pass through.  If not, then they will be redirected to an error page
     * 
     *  If the user has not yet been filtered, (determined by the presence of details available in the user's
     *  current session), then the filter will check the validation code for validity and/or allow or reject
     *  access.
     *
     */
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        if (!activationInfoPopulated()) {
            String activationCode = request.getParameter(ACTIVATION_CODE_PARAM_KEY);
            if (StringUtils.isEmpty(activationCode)) {
                throwActivationInvalid();
            } else {
                try {
                    ActivationService aService = new ActivationService();
                    ClPersonInfo info = aService.findActivationCodeUser(activationCode);
                    if (info == null) {
                        throwActivationInvalid();
                    }
                    userInfo.setClPersonInfo(info);
                    setActivationInfoPopulated();
                    setActivationValid();
                } catch (ServiceUnavailableException sue) {
                    throw new IamwebApplicationException(sue.getMessage());
                } 
            }
        } else {
            // if the validationCode is not valid, send the user directly to error page.  Else, continue...
            if (!activationInfo.getValidationCodeIsValid()) {
                throw new ActivationCodeInvalidException();
            } 
        }
        // if all is good, continue along the chain
        chain.doFilter(request, response);
    }

    private boolean activationInfoPopulated() {
        return (activationInfo.getValidationCodeChecked());
    }

    private void setActivationInfoPopulated() {
        activationInfo.setValidationCodeChecked(Boolean.TRUE);
    }

    private void setActivationValid() {
        activationInfo.setValidationCodeIsValid(Boolean.TRUE);
    }

    private void setActivationInvalid() {
        activationInfo.setValidationCodeIsValid(Boolean.FALSE);
    }

    private void throwActivationInvalid() throws ActivationCodeInvalidException {
        setActivationInfoPopulated();
        setActivationInvalid();
        throw new ActivationCodeInvalidException();
    }

    @Override
    public void destroy() {
        // TODO Auto-generated method stub

    }

    /**
     * @return the activationInfo
     */
    public ActivationInfo getActivationInfo() {
        return activationInfo;
    }

    /**
     * @param activationInfo the activationInfo to set
     */
    public void setActivationInfo(ActivationInfo activationInfo) {
        this.activationInfo = activationInfo;
    }

    /**
     * @return the userInfo
     */
    public UserInfo getUserInfo() {
        return userInfo;
    }

    /**
     * @param userInfo the userInfo to set
     */
    public void setUserInfo(UserInfo userInfo) {
        this.userInfo = userInfo;
    }   
}

and the UserInfo and ActivationInfo are both @SessionScoped as follows:

@Named("activationInfo")
@SessionScoped
public class ActivationInfo implements Serializable {
    private static final Logger logger = LoggerFactory.getLogger(ActivationInfo.class);
    private static final long serialVersionUID = -6864025809061343463L;
    private Boolean validationCodeChecked = Boolean.FALSE;
    private Boolean validationCodeIsValid = Boolean.FALSE;
    private String validationCode;

    @PostConstruct
    public void init() {
        FacesContext context = FacesContext.getCurrentInstance();
        HttpSession session = (HttpSession) context.getExternalContext().getSession(true);
        logger.debug("ActivationInfo being constructed for sessionId:  " + (session == null ? " no session found " : session.getId()));
    }

and

@Named("userInfo")
@SessionScoped
public class UserInfo implements Serializable {
    private static final Logger logger = LoggerFactory.getLogger(UserInfo.class);
    private static final long serialVersionUID = -2137005372571322818L;
    private ClPersonInfo clPersonInfo;
    private String password;

    /**
     * @return the clPersonInfo
     */
    public ClPersonInfo getClPersonInfo() {
        return clPersonInfo;
    }

    @PostConstruct
    public void init() {
        FacesContext context = FacesContext.getCurrentInstance();
        HttpSession session = (HttpSession) context.getExternalContext().getSession(true);
        logger.debug("UserInfo being constructed for sessionId:  " + (session == null ? " no session found" : session.getId()));
    }

When I try to access a page that invokes the filter, I see the following on the console:

2014-02-20 21:32:22 DEBUG UserInfo:35 - UserInfo being constructed for sessionId:   no session found
2014-02-20 21:32:22 DEBUG ActivationInfo:27 - ActivationInfo being constructed for sessionId:   no session found 
2014-02-20 21:32:22 DEBUG VerificationFilter:38 - ************VerificatoniFilter initializing*************

And if I go to a different browser and enter a "bad" verification code, the UserInfo/ActivationInfo are never re-injected. IE, with a different session, I do NOT see a new UserInfo/ActivationInfo.

My questions are: 1. Why is there no session found when the UserInfo/ActivationInfo are being constructed (see the log messages) 2. How can I implement this so that the UserInfo and ActivationInfo can be injected in my other CDI beans later on so that they have the user/activationInfo that I need? Currently because of this problem, I'm setting the activationInfo directly on the user's session in the VerificationFilter, but when I inject to my CDI bean, a DIFFERENT UserInfo and DIFFERENT ActivationInfo are injected.

I'm using Tomcat 7 with JEE 6, WELD.

Thanks in advance!

Answer 1

If you're using Tomcat 7, then you don't have a full Java EE 6 container, so JSF and CDI are not available by default, and it's not clear how you've set them up.

Actually, I'd expect context.getExternalContext() to throw a NullPointerException in your session-scoped beans, since there is no FacesContext when the bean methods are called by the filter.

The filter is invoked before the FacesServlet has had a chance to set up a FacesContext.

So it seems your question is based on unclear and/or incorrect assumptions.