java - spring @SessionAttributes and "Cannot create a session after the response has been committed" -

i trying set , session attribute, either have misunderstood how works or i've done wrong.

please explain why doesn't work.

i have following simple spring web mvc controller

@controller @sessionattributes("sessid") @requestmapping("sesstest") public class sesstest  {     @requestmapping("in")     @responsebody     public string in(modelmap model){         string uuid = uuid.randomuuid().tostring();         model.addattribute("sessid", uuid);         return uuid;     }      @requestmapping("out")     @responsebody     public string out(@modelattribute("sessid") string sesid){         return sesid;     } } 

this class should set session variable when calling /sesstest/in , recall when calling /sesstest/out

but following exception when calling /in

(the stacktrace shown on console, web output ok)

java.lang.illegalstateexception: cannot create session after response has been committed     @ org.apache.catalina.connector.request.dogetsession(request.java:2872)     @ org.apache.catalina.connector.request.getsession(request.java:2249)     @ org.apache.catalina.connector.requestfacade.getsession(requestfacade.java:895)     @ org.springframework.web.context.request.servletrequestattributes.getsession(servletrequestattributes.java:111)     @ org.springframework.web.context.request.servletrequestattributes.setattribute(servletrequestattributes.java:161)     @ org.springframework.web.bind.support.defaultsessionattributestore.storeattribute(defaultsessionattributestore.java:55)     @ org.springframework.web.method.annotation.sessionattributeshandler.storeattributes(sessionattributeshandler.java:124)     @ org.springframework.web.method.annotation.modelfactory.updatemodel(modelfactory.java:232)     @ org.springframework.web.servlet.mvc.method.annotation.requestmappinghandleradapter.getmodelandview(requestmappinghandleradapter.java:879)     @ org.springframework.web.servlet.mvc.method.annotation.requestmappinghandleradapter.invokehandlemethod(requestmappinghandleradapter.java:782)     @ org.springframework.web.servlet.mvc.method.annotation.requestmappinghandleradapter.handleinternal(requestmappinghandleradapter.java:705)     @ org.springframework.web.servlet.mvc.method.abstracthandlermethodadapter.handle(abstracthandlermethodadapter.java:85)     @ org.springframework.web.servlet.dispatcherservlet.dodispatch(dispatcherservlet.java:959)     @ org.springframework.web.servlet.dispatcherservlet.doservice(dispatcherservlet.java:893)     @ org.springframework.web.servlet.frameworkservlet.processrequest(frameworkservlet.java:966)     @ org.springframework.web.servlet.frameworkservlet.doget(frameworkservlet.java:857)     @ javax.servlet.http.httpservlet.service(httpservlet.java:618)     @ org.springframework.web.servlet.frameworkservlet.service(frameworkservlet.java:842)     @ javax.servlet.http.httpservlet.service(httpservlet.java:725)     @ org.apache.catalina.core.applicationfilterchain.internaldofilter(applicationfilterchain.java:291)     @ org.apache.catalina.core.applicationfilterchain.dofilter(applicationfilterchain.java:206)     @ org.apache.tomcat.websocket.server.wsfilter.dofilter(wsfilter.java:52)     @ org.apache.catalina.core.applicationfilterchain.internaldofilter(applicationfilterchain.java:239)     @ org.apache.catalina.core.applicationfilterchain.dofilter(applicationfilterchain.java:206)     @ org.springframework.web.filter.hiddenhttpmethodfilter.dofilterinternal(hiddenhttpmethodfilter.java:77)     @ org.springframework.web.filter.onceperrequestfilter.dofilter(onceperrequestfilter.java:107)     @ org.apache.catalina.core.applicationfilterchain.internaldofilter(applicationfilterchain.java:239)     @ org.apache.catalina.core.applicationfilterchain.dofilter(applicationfilterchain.java:206)     @ org.springframework.web.filter.characterencodingfilter.dofilterinternal(characterencodingfilter.java:85)     @ org.springframework.web.filter.onceperrequestfilter.dofilter(onceperrequestfilter.java:107)     @ org.apache.catalina.core.applicationfilterchain.internaldofilter(applicationfilterchain.java:239)     @ org.apache.catalina.core.applicationfilterchain.dofilter(applicationfilterchain.java:206)     @ org.apache.catalina.core.standardwrappervalve.invoke(standardwrappervalve.java:219)     @ org.apache.catalina.core.standardcontextvalve.invoke(standardcontextvalve.java:106)     @ org.apache.catalina.authenticator.authenticatorbase.invoke(authenticatorbase.java:501)     @ org.apache.catalina.core.standardhostvalve.invoke(standardhostvalve.java:142)     @ org.apache.catalina.valves.errorreportvalve.invoke(errorreportvalve.java:79)     @ org.apache.catalina.core.standardenginevalve.invoke(standardenginevalve.java:88)     @ org.apache.catalina.connector.coyoteadapter.service(coyoteadapter.java:516)     @ org.apache.coyote.http11.abstracthttp11processor.process(abstracthttp11processor.java:1086)     @ org.apache.coyote.abstractprotocol$abstractconnectionhandler.process(abstractprotocol.java:659)     @ org.apache.coyote.http11.http11nioprotocol$http11connectionhandler.process(http11nioprotocol.java:223)     @ org.apache.tomcat.util.net.nioendpoint$socketprocessor.dorun(nioendpoint.java:1558)     @ org.apache.tomcat.util.net.nioendpoint$socketprocessor.run(nioendpoint.java:1515)     @ java.util.concurrent.threadpoolexecutor.runworker(threadpoolexecutor.java:1142)     @ java.util.concurrent.threadpoolexecutor$worker.run(threadpoolexecutor.java:617)     @ org.apache.tomcat.util.threads.taskthread$wrappingrunnable.run(taskthread.java:61)     @ java.lang.thread.run(thread.java:745) 

thanks!

officially "works designed".

in scenario, various workarounds are:

1. manually start session
2. use filter ensure session present
3. use view render model.

see rossen's clear response here: https://jira.spring.io/browse/spr-12877

the scenario unusual since typically model attributes used rendering views (e.g. html template). @responsebody return value used render response. said use of @responsebody doesn't preclude use of @sessionattributes. error has trying create session first time late. use of spring security filter store authentication in session ensures there http session. in absence of add own filter or handlerinterceptor calls request.getsession(true). that's enough ensure session present.

can't argue that.