Missing handshake session leads to NPE in Jetty

[ddworak]

Describe the bug
After upgrading from Atmosphere 2.7.11 to Atmosphere 2.7.13, new connections started failing with NPEs on our Jetty 10 JSR356 backend:

16:01:52.946 [qtp661047965-19] ERROR o.a.container.JSR356Endpoint - 
java.lang.NullPointerException: Cannot invoke "javax.servlet.http.HttpSession.getAttributeNames()" because "this.handshakeSession" is null
	at org.atmosphere.container.JSR356Endpoint.onOpen(JSR356Endpoint.java:229)
	at org.eclipse.jetty.websocket.javax.common.JavaxWebSocketFrameHandler.onOpen(JavaxWebSocketFrameHandler.java:176)
	at org.eclipse.jetty.websocket.core.internal.WebSocketCoreSession.lambda$onOpen$6(WebSocketCoreSession.java:411)
	at org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1469)
	at org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1488)
	at org.eclipse.jetty.websocket.core.server.internal.AbstractHandshaker$1.handle(AbstractHandshaker.java:212)
	at org.eclipse.jetty.websocket.core.internal.WebSocketCoreSession.onOpen(WebSocketCoreSession.java:411)
	at org.eclipse.jetty.websocket.core.internal.WebSocketConnection.onOpen(WebSocketConnection.java:551)
	at org.eclipse.jetty.io.AbstractEndPoint.upgrade(AbstractEndPoint.java:451)
	at org.eclipse.jetty.server.HttpConnection.upgrade(HttpConnection.java:424)
	at org.eclipse.jetty.server.HttpConnection.onCompleted(HttpConnection.java:455)
	at org.eclipse.jetty.server.HttpChannel.onCompleted(HttpChannel.java:959)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:489)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:287)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)
	at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:421)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:390)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:277)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.produce(AdaptiveExecutionStrategy.java:193)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:969)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1194)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1149)
	at java.base/java.lang.Thread.run(Thread.java:840)

I believe this was introduced in #2504, which assumes that the session is not null. The javax.websocket.server.HandshakeRequest#getHttpSession docs provide null as a valid implementation when running outside of a Java EE container.

Atmosphere Info

• 2.7.13
• 3.1.3
• extensions used: none

Expected behavior
Continue working without unavailable handshake session headers.

Systems (please complete the following information):

• Java 17
• Jetty 10.0.20

Additional context
UdashFramework/udash-core#1212

[jfarcand]

@ddworak On it!

[ddworak]

Thanks a lot @jfarcand! 👏