magento xmlrpc session expires immediately

Question

First up; this question is similar to another as-yet unresolved question: call to magento soap api expires immediately

I am working on an XMLRPC-based client-server module. The Magento-based server has several API methods exposed to a Java-based client. I use the standard Java XMLRPC Jars in my client.

I have a "login" call that retrieves a session. I then pass this around to do different calls. I checked that this returns (What looks like) a valid session.

Object result1 = client.execute("login", ob1);
session = (String) result1;

The next call I make using this session, though, fails with:

org.apache.xmlrpc.XmlRpcException: Session expired. Try to relogin.

What I have verified:

• Set the Session Timeout in Magento to a high value
  • This does not work
• Verify Server time setting is ok
  • it is.
• Verify API user is "Active" in Magento
  • Yep.
• Check the api_session table for the session hash
  • See below.

api_session table

• This does not have my current session hash.
• It also has only 11 entries; I have logged in about 50 times atleast.
• Session log times vary significantly from select CURRENT_TIME
  • Update: This is irrelevant (MySQL is recording in GMT)

Here is what I see:

mysql> select * from api_session limit 50;
+---------+---------------------+----------------------------------+
| user_id | logdate             | sessid                           |
+---------+---------------------+----------------------------------+
|       5 | 2013-02-01 16:01:49 | 9099b50
|       5 | 2013-02-01 16:02:10 | 7312c1a
|       5 | 2013-02-01 16:05:43 | a6ce30c
+---------+---------------------+----------------------------------+
11 rows in set (0.00 sec)

mysql> select CURRENT_TIME;
+--------------+
| CURRENT_TIME |
+--------------+
| 14:58:03     |
+--------------+

Answer 1

ummm.... This may have been due to my own need for security.

In the above failures my login method took tips from this article: Irretrievably destroying data in Java

Like that article advised, I was passing a char array to the login method. This was ultimately resulting in empty credentials being passed to the login method.

The flow to those who may be unfamiliar is

• The login method that gets called is in Mage/Api/Model/Server/Handler/Abstract.php
• This calls the login method in Mage/Api/Model/Session.php
• I dumped the inputs into log, they came up empty.

I went back to using my regular, non-secure method of directly passing strings to the method. That worked!

EDIT: Of course this has the disadvantage that I'm back to using strings instead of char[] arrays. Will update answer if I figure out how to do that.