Why is the container sharing my EJB stateful session bean across various sessions?

Question

I have this simple Stateful session bean (a single op stack calculator):

package beans;
import java.util.EmptyStackException;
import java.util.Stack;
import javax.ejb.LocalBean;
import javax.ejb.Stateful;
@Stateful
@LocalBean
public class StackCalcBean {
    private static int instanceCounter = 0;
    private int instanceID;
    private Stack<Double> stack;
    public StackCalcBean() {
        instanceCounter++;
        instanceID = instanceCounter;
        stack = new Stack<>();
    }
    public void push(double d) {
        stack.push(d);  
    }
    public String plus() {
        try {
            double d = stack.pop() + stack.pop();
            stack.push(d);
            return Double.toString(d);
        } catch (EmptyStackException e) {
            return "Empty Stack !";
        }
    }
    public String myToString() {
        return "StackCalc [instanceID=" + instanceID + ", stack=" + stack + "]";
    }
}

That works fine with this servlet:

package servlets;
import java.io.IOException;
import java.io.PrintWriter;
import java.util.EmptyStackException;
import java.util.Scanner;

import javax.ejb.EJB;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import beans.StackCalcBean;

@WebServlet("/StackCalc")
public class StackCalcServlet extends HttpServlet {
    private static final long serialVersionUID = 1L;
    @EJB 
    private StackCalcBean calc;

    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        doPost(request, response);
    }

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        System.out.println("In doPost");
        String input = request.getParameter("input");
        boolean newResult = false;
        String value = "no value";
        String boxStyle = "font-size:18pt;padding:30px;width:650px;margin:auto;"
                + "border:solid;border-width:1px;border-radius:15px;" 
                + "margin-top:40px;";
        if (input != null) {
            Scanner in = new Scanner(input);
            if (in.hasNextDouble()) {
                double n = Double.parseDouble(input);
                calc.push(n);
            } else {
                switch (input) {
                case "+" : value = calc.plus(); break;
                }
                newResult = true;
            }
            in.close();
        }
        response.setContentType( "text/html" );
        try ( PrintWriter out = response.getWriter() ) {
            out.println("<!DOCTYPE html>");
            out.println("<html><head><title>StackCalc</title></head><body>");
            out.println("<div style='"+boxStyle+"'>Session: "+ 
                        request.getSession() + " " + request.getSession().getId() + "</div>");
            out.println("<div style='"+boxStyle+"'>StackCalcBean: "+ calc.myToString() + "</div>");
            out.println( "<div style='"+boxStyle+"'><form method='POST' action='StackCalc'>" );
            if (newResult) {
                out.println("<div>"+value+"</div>");
            }
            out.println( "Input :" ); 
            out.println( "<input name='input' type='text' autofocus />" );
            out.println( "<input name='btnSubmit' type='submit' value='Send' /><br/>" );
            out.println( "</div></body></html>" );
        }
    }
}

That works well except that the same bean is given by the container in different sessions. I know sessions are not the same because I print the session ID and I use different clients on different machines. I know the bean is the same because it has the same instanceID value and the same stack contents.

I was expecting that I would get a new calculator instance if running a client on a different machine.

I tried with WildFly 21 and Glassfish 5 and I get the same behavior.

Clearly, I am missing something.

Edit: A solution may consist in associating explicitly the calc instance to the web session:

StackCalcBean calc = null;
if (request.getSession().getAttribute("calc") == null) {
     try {
        InitialContext ctx= new InitialContext();
        calc = (StackCalcBean) ctx.lookup("java:module/StackCalcBean!beans.StackCalcBean");
        request.getSession().setAttribute("calc", calc);
    } catch (NamingException e) {
        e.printStackTrace();
    }
} else {
   calc = (StackCalcBean) request.getSession().getAttribute("calc");
}

score 3 · Answer 1 · answered Dec 09 '20 at 15:20

The "session" in "Stateful Session EJBs" has nothing to do with the "session" in the servlet container!

What I mean (because, yes, this is a confusing matter): The servlet container can maintain a web "session", represented by the HttpSession interface. This can be seen as a region in the server's memory that stores any information that needs to live longer than a single HTTP request. This information can be shared by subsequent HTTP requests. A request must carry some kind of identification, linking it to the server-side "session" memory. This is usually a cookie.

A "Stateful Session EJB" implements a similar concept: A piece of server memory plus functionality, that persists until either removed explicitly or timed-out due to inactivity. Each instance of a "Stateful Session EJB" has an id, similar to the id used to identify the web session (e.g. the cookie), but this id has absolutely no connection to the web session! In fact, it does not require a web session at all!

The old, manual way of creating EJBs through the home interface made this distinction more explicit. Every time you call a home creation method, you get a new instance of the stateful EJB. You may call it from code that is NOT part of a web request/session (e.g. a client, a timer, a message handler), so there is NO active web session; or you may call it several times and get as many references to individual instances of the stateful EJB. You may even share the same instance of the stateful EJB across web sessions, if you pass the reference.

With @EJB it seems that the stateful EJB instance is bound to the life of the component it is injected into. In this case, as long as the servlet instance lives, it uses the same stateful EJB instance. And the servlet instances are usually globals (anyway, they are handled by the application server, so one servlet instance may serve many requests, even in parallel). That is why you are getting this behavior.

One way to work around this is with CDI. You can bind the EJB to the web session by marking it as @SessionScoped:

@SessionScoped
@Stateful
@LocalBean
public class StackCalcBean {
    ...
}

And inject it with CDI:

@WebServlet("/StackCalc")
public class StackCalcServlet extends HttpServlet {
    ...
    @Inject
    private StackCalcBean calc;
    ...
}

Footnote: CDI is, in my opinion, much more versatile and reliable than EJB. If you go for the CDI solution, you can even skip the EJB annotations completely, thus making the StackCalcBean a true CDI component. In other words, you do not need it to be EJB anymore. If you do, remember there are some functional differences, e.g. EJBs are transactional by default, CDI beans simply need the @Transactional annotation.

Thank you very much for the detailed answer. CDI solved the problem. I came up with an alternative solution (I edited my question) that is certainly less elegant. — Thibault Langlois, Dec 10 '20 at 17:21

Why is the container sharing my EJB stateful session bean across various sessions?

1 Answers1