Context.sessionAttribute should not create a new session

Actual behavior (the bug)

When using ctx.sessionAttribute(String key), this can create a new session, if no session exists yet. While this is generally not much of a problem, this leads to an IllegalStateException when called in a request logger, where the response is already committed. See here for the code in Jetty Request class, https://github.com/eclipse/jetty.project/blob/jetty-9.4.x/jetty-server/src/main/java/org/eclipse/jetty/server/Request.java#L1599-L1637

I know changing this would lead to BWC breaking behaviour, so I figured we should first talk about this before I do a PR 😃

Expected behavior Retrieving the session so no new sessions gets created. My current workaround is

final HttpSession session = ctx.req.getSession(false);
if (session != null && session.getAttribute("user") instanceof User user) {
    // do sth fancy here...
}

To Reproduce Call `ctx.sessionAttribute(“whatever”) in a request logger when your request has not done any session handling so far.

[tipsy]

Adjusting for your last comments, it becomes:

req.getSession(false)?.getAttribute("user") // get attribute (note the ?)
req.getSession(true).getAttribute("user", user) // set attribute

Setting will create, but reading will not. Attempting to read a session attribute if no session attribute has been set will result in a null value (not a nullpointer).

---

This sounds acceptable, but it could potentially break existing apps. It doesn’t sound very likely that it will though? 🤔

[spinscale]

Yes, checking for the session being null in ctx.sessionAttribute("user") and returning null as well, if the session has not been created, otherwise the same behaviour as before.