3

Scenario:

In case of simultaneous usage by multiple users the cookie based login sometimes gets overridden causing one user to see other users information.

Session is completely cookie based and each request to server is authenticated with database via encoded values in cookies for valid user and session.

Application uses spring MVC framework.The application runs fine except for when hundreds of users hits the website at the same time. There are few concurrent issues. Data of one user is getting exchanged with another.

We are facing trouble in reproducing the issue. We have limited Testing resources , which are tools/Methods we should follow to replicate the issue.

Improve this question
2
  • 1
    Well, the issue likely isn't caused by the volume of users but more likely caused by the timing of those users. You don't need 100, you need maybe 5 that are exchanging data at the same exact times in order to achieve the results.
    – Paul Muir
    Dec 22, 2014 at 14:02
  • @PaulDonny :- Thanks , how you would have replicated the scenario , which tools/Methods i should use.
    – Abhijeet Gupta
    Dec 23, 2014 at 7:00

3 Answers 3

Reset to default
2

The cause of this issue

Overall, the cause of this issue is poor multi-threading programming. What is happening is there is likely a static method that is being shared that tracks the user's account. If 2 users access a page at the same time, it is using the second user's log-in in the static method and returning for the first user the 2nd user's information.

Testing this issue

Sadly, this is one of those difficult to test scenarios. A load tester will be beneficial but will not be the key to detecting this. The load testing options will simply put the requests you need into the service. I would personally suggest, if you have the skillset, a custom built HTTP requester that will severely thread out about 100 concurrent users. This will not determine your problem but give you the ability to discover the issue.

The next step would be to send request manually through your browser with a different log-in. After a while you should be able to detect the issue and manually verify.

Post-fix verification

Sadly being what could be considered an intermittent issue this could be difficult to verify. Your best option would likely be to drastically limit the RAM available to your server (I gave Apache since Java but a google search will net results for most other servers). This would slow down the process enough to hopefully detect the problem and be rather repeatable.

Another option would be using debug mode and pausing the execution of the first request and sending a second request.

Warning

This means that your developer(s) might not be overly experienced with managing threads. This can be an extremely complex and difficult task. I would heavily test and focus on any and all other multi-threaded portions of your code in order to ensure that they are not experiencing the same issues.

Improve this answer
2
  • Does limiting RAM slow down the process because of necessary memory-to-disk swapping? Why or how slowing down the process helps makes this intermitten issue easier to reproduce?
    – dzieciou
    May 2, 2015 at 11:53
  • 1
    Because most intermittent issues usually deal with concurrency problems. By reducing the RAM and/or processing power it will increase the amount of time it will take for the system to handle each request and, hopefully, cause the system to reproduce the issue.
    – Paul Muir
    May 5, 2015 at 12:42
1

I would try to reproduce the issue with the open-source FunkLoad, see the getting started tutorial.

FunkLoad emulates the browser (including cookies):

Truly emulates a web browser (single-threaded) using an enhanced Richard Jones’ webunit:

  • basic authentication support
  • cookies support

It can scale up to hundreds of simultaneous connections from a single machine.

High level plan:

  • Setup test environment to run the test against
  • Record test steps with FunkLoad recorder
  • Edit the generated Python script to use a unique user for each session (maybe insert the user into the test database at the start of the test.)
  • Add asserts to verify the pages are loading correctly
  • Run the Benchmark runner with 2-3 users to verify everything works
  • Scale up until it fails

Load testing could bring your whole infrastructure down, I would advise to run against a separate environment. If this is a one time thing maybe setup some test machines in a cloud environment.

Improve this answer
5
  • How different "FunkLoad recorder" is from "JMeter" ? what more/extra edge we get from using FunkLoad.
    – Abhijeet Gupta
    Dec 23, 2014 at 6:57
  • I found the jMeter GUI not very intuitive, maybe its just me, but it took me to much time to get it going like I wanted too. I like the fact that FunkLoad generates Python unit-test code which is relative easy to manipulate and extend. I don't know what the jMeter recorder generates, but I have the feeling it just creates steps in the interface. Also if you are familiar with command-line tools you will feel right at home with FunkLoad.
    – Niels van Reijmersdal
    Dec 23, 2014 at 8:15
  • To be honest i never worked with python scripts , hence just have feeling to go with it or not , and will be take much of my time ?
    – Abhijeet Gupta
    Dec 23, 2014 at 8:22
  • If you already have experience with jMeter it might be better to continue with that, since it is similar and the High level plan will work with that too I expect. Maybe you can find a developer to help you get started, they should be able to pick up Python pretty fast. I cannot estimate your time, but I setup an initial test within a day or so.
    – Niels van Reijmersdal
    Dec 23, 2014 at 8:29
  • Thanks , even me getting interested into "funkLoad" , it's Command line stuff & never too late to try something new. Is there any video tutorial or better site with examples for "FunkLoad" ?
    – Abhijeet Gupta
    Dec 23, 2014 at 8:40
0

I would recommend using Apache JMeter to simulate increasing number of users. It can look pretty much a real browser (apart from lack of JavaScript support), however supported browser's functionality include:

There are also several JMeter Assertions available so you can assure whether the response contains what it should or doesn't contain what it shouldn't.

Official User Manual is very good, if you prefer videos there is JMeter Tutorial Video Series available.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.