SonarSource/sonarqube · error · UnsupportedOperationException

Sessions are disabled so that web server is stateless

Error message

Sessions are disabled so that web server is stateless

What it means

UnsupportedOperationException thrown by the request-wrapper's getSession(boolean) when create=true. SonarQube's web server is intentionally stateless: HTTP sessions are disabled, so any code (often a filter or library) that tries to create a session fails with this message.

Solutions

1. Remove or disable code that calls getSession(true); operate statelessly (headers/tokens instead of sessions).
2. Replace session-based auth plugins with token-based authentication (user tokens, JWT).
3. Call getSession(false) if you only need to inspect an existing session and tolerate null.
4. If sessions are mandatory, this is unsupported on the SonarQube web server; use an external gateway for session handling.

Example fix

// before
HttpSession session = request.getSession(true);
// after
HttpSession session = request.getSession(false); // null when stateless, no throw
if (session == null) { /* authenticate via Authorization header instead */ }

// Java: avoid creating sessions in SonarQube filters
boolean sessionAllowed = false; // SonarQube web server is stateless by design

HttpSession existing = request.getSession(false);
boolean hasSession = existing != null;

try {
  HttpSession s = request.getSession(false);
  useIfPresent(s);
} catch (UnsupportedOperationException e) {
  // stateless path
}

When it happens

Trigger: Any servlet filter/valve or third-party security library calling request.getSession(true) on requests passing through RootFilter; deploying a plugin that relies on server-side sessions (e.g. form-based SSO plugins).

Common situations: Installing session-based authentication plugins; proxy/portal integrations expecting JSESSIONID; custom filters copied from non-Sonar servlet apps.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• A plugin is storing excessively large data in the following…
• A version event already exists on analysis
• Ad-hoc rules export failed after processing
• An DevOps Platform setting with key
• An ' ' event with the same name already exists on analysis

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/2dda6ea8d903d6f0. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-core/src/main/java/org/sonar/server/platform/web/RootFilter.java:108

  @Override
  public void destroy() {
    // Nothing
  }

  @VisibleForTesting
  static class ServletRequestWrapper extends HttpServletRequestWrapper {
    private String body;

    ServletRequestWrapper(HttpServletRequest request) {
      super(request);
    }

    @Override
    public HttpSession getSession(boolean create) {
      if (!create) {
        return null;
      }
      throw notSupported();
    }

    @Override
    public HttpSession getSession() {
      throw notSupported();
    }

    private static UnsupportedOperationException notSupported() {
      return new UnsupportedOperationException("Sessions are disabled so that web server is stateless");
    }

    @Override
    public BufferedReader getReader() throws IOException {
      if (body == null) {
        body = getBodyInternal((HttpServletRequest) getRequest());
      }
      return new BufferedReader(new StringReader(body));
    }

View on GitHub (pinned to 184c821202)