private-session-attributes property does not work in Liferay 7

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.0 DXP GA1, 7.0.2 CE GA3
• Fix Version/s: 7.0.0 DXP FP8, 7.0.0 DXP SP2, 7.0.3 CE GA4, Master
• Component/s: Core Infrastructure, Core Infrastructure > Servlet JSP Compiler
• Labels:
  • escalation
  • liferay-digital-enterprise-70-sp2
  • liferay-fixpack-de-8-7010
• Branch Version/s:
  7.0.x
• Backported to Branch:
  Committed
• Story Points: 1.5
• Fix Priority: 4

Before Liferay 7 portlets could share session attributes by setting <private-session-attributes>false</private-session-attributes> in liferay-portlet.xml. With modularization this stopped working.

Steps to reproduce:

1. Create two portlets that have render methods like below (or use the attached bundles session.test-1.0.0.jar and session.test2-1.0.0.jar) and deploy them:
   Attribute setter portlet:

   	@Override
   	public void render(RenderRequest request, RenderResponse response) throws PortletException, IOException {
   
   		PortletSession ps = request.getPortletSession();
   		Object obj = ps.getAttribute("my_test_portlet_attr", PortletSession.APPLICATION_SCOPE);
   
   		if (obj == null) {
   			String attributeToShare = "Shared Value";
   			ps.setAttribute("my_test_portlet_attr", attributeToShare, PortletSession.APPLICATION_SCOPE);
   		}
   
   		super.render(request, response);
   	}
   

   Attribute getter portlet:

   	@Override
   	public void render(RenderRequest request, RenderResponse response) throws PortletException, IOException {
   
   		PortletSession ps = request.getPortletSession();
   		Object obj = ps.getAttribute("my_test_portlet_attr", PortletSession.APPLICATION_SCOPE);
   
   		if (obj == null) {
   			System.out.println("PortletSession attribute NOT found");
   		} else {
   			System.out.println("PortletSession attribute found: " + obj);
   		}
   
   		super.render(request, response);
   	}
   

2. Put the portlets on the same page
3. Refresh the page

Expected: In log the message appears: PortletSession attribute found: Shared Value
Actual: In log the message appears: PortletSession attribute NOT found

The problem is that Equinox gives its own session implementation: org.eclipse.equinox.http.servlet.internal.servlet.HttpSessionAdaptor. This class has an attributePreffix property which is unique per bundle and is used to prefix the attribute name thus preventing portlet session sharing across bundles/contexts. As a result, session attribute sharing doesn't work.