[JENKINS-72113] Relax serialization of BoundObjectTable.Table

[Vlatombe]

JENKINS-72113

Testing done

Submitter checklist

Preview Give feedback

1. Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
2. Ensure that the pull request title represents the desired changelog entry
3. Please describe what you did
4. Link to relevant issues in GitHub or Jira
5. Link to relevant pull requests, esp. upstream and downstream changes
6. Ensure you have provided tests - that demonstrates feature works or fixes the issue

[daniel-beck]

Noting that while this will skip some (most?) bound objects, possibly resulting in the current page being broken after session deserialization (requiring reload), that's a net improvement over not being able to serialize the session at all (and being logged out, having to log in again all over) in a suitably set up environment.

[jglick]

Right, this brings Stapler closer to compliance with the spec because at least other parts of the session, most crucially the login state, can be distributed.

To expand: in a deserialized session,

stapler/core/src/main/java/org/kohsuke/stapler/bind/BoundObjectTable.java

Lines 172 to 175 in 892bddc

	if (v==null) {
	if (logging) LOGGER.warning(toString() + " had binding for " + id + " but it got garbage collected");
	entries.remove(id); // reference is already garbage collected.
	}

might be triggered. The impact would be that /$stapler/bound/… requests would give a 404 from

stapler/core/src/main/java/org/kohsuke/stapler/bind/BoundObjectTable.java

Lines 157 to 159 in 892bddc

	public Object getDynamic(String id) {
	return resolve(id);
	}

so any JavaScript running on the page (such as from a l:progressiveRendering) would stop with an error and the user would need to reload the page. (Similar to what already happens if your session expires while the page is open, or you log out in another tab, or the controller restarts, etc.)

This could be improved in the future to

• st:bind a Serializable object
• implement WithWellKnownURL
• use other mechanisms for dynamic page content (other JS frameworks, REST API calls)

on a case-by-case basis; certain usages of st:bind (such as ProgressiveRendering) do not seem to lend themselves to distributed state without an incompatible rewrite.

In a standard Winstone setup, sessions are never serialized so this patch would have no effect.

[timja]

/label ready-for-merge

---

This PR is now ready for merge, after ~24 hours, we will merge it if there's no negative feedback.

Thanks!