Jetty keeps Sessions in use after "Duplicate valid session cookies" Message

[ssoec4u]

Jetty version
9.4.26

Java version
openjdk version "10.0.2" 2018-07-17

OS type/version
CentOS Linux 7 (core)

Description
After getting org.eclipse.jetty.http.BadMessageException: 400: Duplicate valid session cookies jetty keeps the duplicate sessions in use state (request counter in session >0). Thats why these session will not be invalidated by the HouseKeeper-Thread.
Is this a bug in jetty?

[janbartel]

@ssoec4u I will put in a fix for this to ensure that duplicate valid sessions have their request counts decremented correctly.

But how the heck did you manage to get multiple sessions with different ids created, and moreover get the client to send more than 1 JSESSIONID cookie?

Also, you're more than 10 releases of jetty behind, it would be best if you could upgrade.

[janbartel]

Fixed via #6088.

[ssoec4u]

@ssoec4u I will put in a fix for this to ensure that duplicate valid sessions have their request counts decremented correctly.

But how the heck did you manage to get multiple sessions with different ids created, and moreover get the client to send more than 1 JSESSIONID cookie?

Also, you're more than 10 releases of jetty behind, it would be best if you could upgrade.

The problem can be understood if you call up a web link from an Excel (Microsoft) in a Window 10 with the current IE Edge. The condition is that the website uses session cookies for this.
If you then call up the link at least twice, the message appears in the log file.