Lots of "Code Review - Session expired" errors after upgrade to 2.5

[Mihai Rusu]

Hi,

After the upgrade from 2.1.8 to 2.5 we've started getting lots of
session timeout errors.

The problem with this error is that it can happen at any time, including
when writing a large comment and clicking to submit it you may get the
error and lose the whole comment. Some users are reporting getting this
error 3-4 times per day.

Pertinent gerrit.config settings:
[cache "web_sessions"]
memoryLimit = 20m
maxAge = 20 hours

"gerrit show-caches" excerpt:
Name |Entries | AvgGet |Hit Ratio|
| Mem Disk Space| |Mem Disk|
--------------------------------+---------------------+---------+---------+
D web_sessions | 83 492 165.88k| | 99% 0%|

The full error page is:
Code Review - Session expired
You are no longer signed in to Gerrit Code Review.
To continue, please sign-in again.

Sign In Close

Another error users are reporting (but it's similarly annoying) is:
HTTP ERROR: 500

Problem accessing /g/login/. Reason:

Cookie GerritAccount was set
Powered by Jetty://

I don't know if the 2 errors are related.

I also see these in Gerrit's error_log:
[2013-02-08 15:03:25,225] WARN org.eclipse.jetty.util.log : /g/login/
java.lang.IllegalStateException: Cookie GerritAccount was set
at
com.google.gerrit.httpd.CacheBasedWebSession.saveCookie(CacheBasedWebSession.java:206)
at
com.google.gerrit.httpd.CacheBasedWebSession.login(CacheBasedWebSession.java:159)
at
com.google.gerrit.httpd.auth.container.HttpLoginServlet.doGet(HttpLoginServlet.java:139)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at
com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:263)
at
com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:178)
at
com.google.inject.servlet.ManagedServletPipeline.service(ManagedServletPipeline.java:91)
at
com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:62)
at
com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:168)
at
com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58)
at
com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:168)
at
com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58)
at
com.google.gwtexpui.server.CacheControlFilter.doFilter(CacheControlFilter.java:76)
at
com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:163)
at
com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58)
at
com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:168)
at
com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58)
at
com.google.gerrit.httpd.RequireSslFilter.doFilter(RequireSslFilter.java:68)
at
com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:163)
at
com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58)
at
com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:168)
at
com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58)
at
com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:168)
at
com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58)
at
com.google.gerrit.httpd.AllRequestFilter$FilterProxy$1.doFilter(AllRequestFilter.java:64)
at
com.google.gerrit.httpd.AllRequestFilter$FilterProxy.doFilter(AllRequestFilter.java:57)
at
com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:163)
at
com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58)
at
com.google.gerrit.httpd.RequestContextFilter.doFilter(RequestContextFilter.java:75)
at
com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:163)
at
com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58)
at
com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:118)
at
com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:113)
at
org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1322)
at
org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:473)
at
org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:224)
at
org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:921)
at
org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:403)
at
org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:184)
at
org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:856)
at
org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:117)
at
org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:114)
at org.eclipse.jetty.server.Server.handle(Server.java:352)
at
org.eclipse.jetty.server.HttpConnection.handleRequest(HttpConnection.java:596)
at
org.eclipse.jetty.server.HttpConnection$RequestHandler.headerComplete(HttpConnection.java:1052)
at
org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:590)
at
org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:212)
at
org.eclipse.jetty.server.HttpConnection.handle(HttpConnection.java:426)
at
org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:510)
at
org.eclipse.jetty.io.nio.SelectChannelEndPoint.access$000(SelectChannelEndPoint.java:34)
at
org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:40)
at
org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:450)
at java.lang.Thread.run(Thread.java:679)

We use the HTTP server for authentication which sets a cookie with the
authenticated username before passing the request to Gerrit (using the
Apache mod_proxy):
[auth]
type = HTTP_LDAP
httpHeader = INTERNAL_USER
cookieSecure = true

[httpd]
listenUrl = proxy-https://localhost:8888/g

Relevant Apache site config:
RewriteRule ^/$ /g/login/ [R]

# Gerrit access.
<Location /g/login/>
... auth options ...
</Location>
ProxyPass /g/ http://127.0.0.1:8888/g/

When I upgraded from 2.1.8 to 2.5 I had to change the Apache config
from redirecting ^/$ to /g/login/mine to be just /g/login/ as you can
see above. These errors might be related...

Thanks!

--
Mihai Rusu