{"record":{"id":"2dda6ea8d903d6f0","repo":"SonarSource/sonarqube","slug":"sessions-are-disabled-so-that-web-server-is-statel","errorCode":null,"errorMessage":"Sessions are disabled so that web server is stateless","messagePattern":"Sessions are disabled so that web server is stateless","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":500,"severity":"error","filePath":"server/sonar-webserver-core/src/main/java/org/sonar/server/platform/web/RootFilter.java","lineNumber":108,"sourceCode":"  @Override\n  public void destroy() {\n    // Nothing\n  }\n\n  @VisibleForTesting\n  static class ServletRequestWrapper extends HttpServletRequestWrapper {\n    private String body;\n\n    ServletRequestWrapper(HttpServletRequest request) {\n      super(request);\n    }\n\n    @Override\n    public HttpSession getSession(boolean create) {\n      if (!create) {\n        return null;\n      }\n      throw notSupported();\n    }\n\n    @Override\n    public HttpSession getSession() {\n      throw notSupported();\n    }\n\n    private static UnsupportedOperationException notSupported() {\n      return new UnsupportedOperationException(\"Sessions are disabled so that web server is stateless\");\n    }\n\n    @Override\n    public BufferedReader getReader() throws IOException {\n      if (body == null) {\n        body = getBodyInternal((HttpServletRequest) getRequest());\n      }\n      return new BufferedReader(new StringReader(body));\n    }","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-core/src/main/java/org/sonar/server/platform/web/RootFilter.java#L90-L126","documentation":"UnsupportedOperationException thrown by the request-wrapper's getSession(boolean) when create=true. SonarQube's web server is intentionally stateless: HTTP sessions are disabled, so any code (often a filter or library) that tries to create a session fails with this message.","triggerScenarios":"Any servlet filter/valve or third-party security library calling request.getSession(true) on requests passing through RootFilter; deploying a plugin that relies on server-side sessions (e.g. form-based SSO plugins).","commonSituations":"Installing session-based authentication plugins; proxy/portal integrations expecting JSESSIONID; custom filters copied from non-Sonar servlet apps.","solutions":["Remove or disable code that calls getSession(true); operate statelessly (headers/tokens instead of sessions).","Replace session-based auth plugins with token-based authentication (user tokens, JWT).","Call getSession(false) if you only need to inspect an existing session and tolerate null.","If sessions are mandatory, this is unsupported on the SonarQube web server; use an external gateway for session handling."],"exampleFix":"// before\nHttpSession session = request.getSession(true);\n// after\nHttpSession session = request.getSession(false); // null when stateless, no throw\nif (session == null) { /* authenticate via Authorization header instead */ }","handlingStrategy":"type-guard","validationCode":"// Java: avoid creating sessions in SonarQube filters\nboolean sessionAllowed = false; // SonarQube web server is stateless by design","typeGuard":"HttpSession existing = request.getSession(false);\nboolean hasSession = existing != null;","tryCatchPattern":"try {\n  HttpSession s = request.getSession(false);\n  useIfPresent(s);\n} catch (UnsupportedOperationException e) {\n  // stateless path\n}","preventionTips":["Never call getSession(true) or getSession() in code deployed into SonarQube.","Use request attributes or client-side state (tokens) instead of sessions.","Audit third-party auth plugins for session dependencies before installing."],"tags":["sonarqube","servlet","stateless","session"],"backgroundTag":"unsupported-operation","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}