We have been using multiple instances of tomcat (using spring boot) 9.x versions on multiple nodes, which handles static + dynamic resources. Intermittently, we have been seeing issues with session management and below given exceptions particularly when multiple static resources like css/js are being accessed from html files.
Aug 24 11:51:38 31f8d4f54c9a security [https-jsse-nio-4700-exec-24] 12e42fb1-c0ef-4717-aad9-cc61b5c40929 org.apache.catalina.core.ContainerBase.[Tomcat].[localhost] Exception Processing /security/images/logo.png
java.lang.NullPointerException: null
at org.apache.catalina.session.StandardSession.doWriteObject(StandardSession.java:1641)
at org.apache.catalina.session.StandardSession.writeObjectData(StandardSession.java:1065)
at org.apache.catalina.session.JDBCStore.save(JDBCStore.java:804)
at org.apache.catalina.valves.PersistentValve.invoke(PersistentValve.java:166)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:834)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.base/java.lang.Thread.run(Thread.java:829)
From different articles and forums (Reference: Why should Tomcat's PersistentValve not be used where there may be concurrent requests per session?), it seems that Persistent Valve assumes that only single request is being sent from the session. This is highly unlikely with web applications that requires many css or js files to be rendered on a webpage.
What alternatives exist to manage and externalize this session without using JDBC Store or Persistent Valve? OR is there any workaround or a way to address this issue?
Please advise.