From 6a5e2c54b5dc8c6eb87844f037e5d594cf71254e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Florian=20B=C3=BCtler?= <florian.buetler@hotmail.com>
Date: Thu, 7 Nov 2024 11:16:27 +0100
Subject: [PATCH] Destroy the session in a follow-up request to ensure the
 session has been flushed to the session store at least once (#2674)

Making sure that the session has been flushed to the session store,
ensures that the serialization/deserialization process of the stored
object has been tested as well.
---
 .../web/handler/SessionHandlerTestBase.java   | 44 ++++++++++++-------
 1 file changed, 29 insertions(+), 15 deletions(-)

diff --git a/vertx-web/src/test/java/io/vertx/ext/web/handler/SessionHandlerTestBase.java b/vertx-web/src/test/java/io/vertx/ext/web/handler/SessionHandlerTestBase.java
index e11505e8fa..7c49f5352f 100644
--- a/vertx-web/src/test/java/io/vertx/ext/web/handler/SessionHandlerTestBase.java
+++ b/vertx-web/src/test/java/io/vertx/ext/web/handler/SessionHandlerTestBase.java
@@ -224,9 +224,10 @@ private boolean testSessionBlocking(String sessionId, Function<Session, Boolean>
 
 	@Test
 	public void testDestroySession() throws Exception {
+        // given
 		router.route().handler(SessionHandler.create(store));
-		AtomicReference<String> rid = new AtomicReference<>();
-		AtomicInteger requestCount = new AtomicInteger();
+        final AtomicReference<String> sid = new AtomicReference<>();
+        final AtomicInteger requestCount = new AtomicInteger();
 		router.route().handler(rc -> {
 			Session sess = rc.session();
 			assertNotNull(sess);
@@ -234,34 +235,47 @@ public void testDestroySession() throws Exception {
 			assertNotNull(sess.id());
 			switch (requestCount.get()) {
 			case 0:
-				rid.set(sess.id());
+                    sid.set(sess.id());
 				sess.put("foo", "bar");
-				sess.destroy();
 				break;
 			case 1:
-				assertFalse(rid.get().equals(sess.id())); // New session
-				assertNull(sess.get("foo"));
-				rid.set(sess.id());
+                    assertEquals(sid.get(), sess.id());
+                    // Destroy session in a follow-up request, so that it has been flushed to
+                    // the session store
 				sess.destroy();
 				break;
+                case 2:
+                    assertFalse(sid.get().equals(sess.id())); // New session
+                    assertNull(sess.get("foo"));
+                    sid.set(sess.id());
+                    sess.destroy(); // Destroy session in the same request as it is created
+                    break;
 			}
 			requestCount.incrementAndGet();
 			rc.response().end();
 		});
+
+        // when
+        final AtomicReference<String> sessionCookie = new AtomicReference<>();
 		testRequest(HttpMethod.GET, "/", null, resp -> {
+            assertTrue(resp.headers().getAll("set-cookie").size() == 1); // expect new session cookie only
 			String setCookie = resp.headers().get("set-cookie");
-			assertNull(setCookie);
-			// the cookie got destroyed even before the end of the request, so no side
-			// effects are expected
+            assertNotNull(setCookie);
+            sessionCookie.set(setCookie.split(";")[0]);
+        }, 200, "OK", null);
+        testRequest(HttpMethod.GET, "/", req -> req.putHeader("cookie", sessionCookie.get()), resp -> {
+            assertTrue(resp.headers().getAll("set-cookie").size() == 1); // expect expired session cookie only
 		}, 200, "OK", null);
-		testRequest(HttpMethod.GET, "/", null, null, 200, "OK", null);
+        testRequest(HttpMethod.GET, "/", req -> req.putHeader("cookie", sessionCookie.get()), null, 200, "OK", null);
+
+        // then
 		Thread.sleep(500); // Needed because session.destroy is async
-		CountDownLatch latch1 = new CountDownLatch(1);
-		store.get(rid.get(), onSuccess(res -> {
+        CountDownLatch latch = new CountDownLatch(1);
+        store.get(sid.get(), onSuccess(res -> {
 			assertNull(res);
-			latch1.countDown();
+            latch.countDown();
 		}));
-		awaitLatch(latch1);
+        awaitLatch(latch);
 	}
 
 	@Test