Hi Isomorphic,

our application works in serveral modes:
  1. Normal Login
  2. Cron Job or Quartz triggered jobs
  3. API access
We only use sessions for normal (and successful) user-logins, as creating too many sessions is a very easy way to DOS yourself.

The other more automated types of accessing the system are request scoped and perhaps store information the ServletRequest, but not in a session.
Additionally EAI tools typically don't support sessions anyway, as this contradicts the REST-statelessness.

It seems though that you unintentionally create sessions as well for every DSRequest. This in turn results in the fact that all our API requests, which use DSRequests via RESTHandler also create a session.

Please have a look at DSRequest.trackTimings():
Click image for larger version

Name:	TrackTimings.PNG
Views:	40
Size:	201.9 KB
ID:	262381

Here it is clearly wrong.

This also affects other parts of the framework:
These are the framework methods that call getSession() (without am explicit false-parameter. This also applies to getSession(true) calls):
Click image for larger version

Name:	Calls of getSession.png
Views:	16
Size:	58.2 KB
ID:	262382

Here you should be using HttpServletRequest.getSession(false) everywhere IMHO.

Can you have a look please and fix this if you agree.

Thank you & Best regards