[Server] Fix NRE in ActivateSession if Session times out before activation completes by romanett · Pull Request #3844 · OPCFoundation/UA-.NETStandard

romanett · 2026-06-05T08:38:08Z

Proposed changes

Fixes a NullReferenceException (NRE) in StandardServer.ActivateSessionAsync that could occur when a session times out between the completion of SessionManager.ActivateSessionAsync and the subsequent GetSession call. A null-guard (?? throw new ServiceResultException(StatusCodes.BadSessionIdInvalid)) is added to handle this race condition safely.

Related Issues

Types of changes

Bugfix (non-breaking change which fixes an issue)
Enhancement (non-breaking change which adds functionality)
Test enhancement (non-breaking change to increase test coverage)
Breaking change (fix or feature that would cause existing functionality to not work as expected, requires version increase of Nuget packages)
Documentation Update (if none of the other choices apply)

Checklist

I have read the CONTRIBUTING doc.
I have signed the CLA.
I ran tests locally with my changes, all passed.
I fixed all failing tests in the CI pipelines.
I fixed all introduced issues with CodeQL and LGTM.
I have added tests that prove my fix is effective or that my feature works and increased code coverage.
I have added necessary documentation (if appropriate).
Any dependent changes have been merged and published in downstream modules.

Further comments

The fix is a minimal, targeted change in StandardServer.cs. Earlier attempts to also modify SessionManager.ValidateRequest and Session.ValidateRequest were reverted because removing the ActivateSession bypass from SessionManager.ValidateRequest caused the secure channel ID check in Session.ValidateRequest to run for reconnect-on-alternate-channel scenarios — a valid OPC UA pattern — resulting in BadSecureChannelIdInvalid errors in the Client test suite (ReconnectJWTAsync, ReconnectSessionOnAlternateChannelAsync, etc.).

codecov · 2026-06-05T08:38:23Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.14%. Comparing base (00519fa) to head (6b1ba92).

Additional details and impacted files

@@              Coverage Diff              @@
##           master378    #3844      +/-   ##
=============================================
+ Coverage      60.11%   60.14%   +0.03%     
=============================================
  Files            378      378              
  Lines          79060    79061       +1     
  Branches       13837    13838       +1     
=============================================
+ Hits           47526    47552      +26     
+ Misses         27105    27090      -15     
+ Partials        4429     4419      -10

Files with missing lines	Coverage Δ
Libraries/Opc.Ua.Server/Server/StandardServer.cs	`70.98% <100.00%> (-0.05%)`	⬇️

... and 12 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

romanett · 2026-06-05T08:38:37Z

@copilot create the same PR based of master branch with merge target master

Copilot · 2026-06-05T08:38:47Z

@romanett I've opened a new pull request, #3845, to work on those changes. Once the pull request is ready, I'll request review from you.

…done Update ClientLastActiveTIme in activate session

…ession expires before activation

romanett · 2026-06-05T10:02:21Z

@copilot Check why the Client Test CI is failing

…onnect-on-alternate-channel

CLAassistant · 2026-06-05T10:12:10Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ romanett
❌ Copilot
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

Copilot · 2026-06-05T10:12:12Z

@copilot Check why the Client Test CI is failing

The Client tests were failing because the SessionManager.cs change removed ActivateSession from the session-lookup bypass, causing session.ValidateRequest() to be called for ActivateSession requests. That method checks IsSecureChannelValid(), which compares the stored channel ID against the incoming channel ID — but OPC UA allows re-activation on a new channel, so reconnect tests like ReconnectJWTAsync and ReconnectSessionOnAlternateChannelAsync all failed with BadSecureChannelIdInvalid.

The actual NRE fix is the null check in StandardServer.cs (GetSession(...) ?? throw new ServiceResultException(StatusCodes.BadSessionIdInvalid)). I've reverted the SessionManager.cs and Session.cs changes so only that null check remains. Fixed in commit $(git rev-parse --short HEAD).

…annelIdInvalid on reconnect PR #3844 explicitly warned that removing the ActivateSession bypass from SessionManager.ValidateRequestAsync (and the matching guard in Session.ValidateRequest) causes the secure channel id check in Session.ValidateRequest to run on reactivation, breaking valid OPC UA reconnect-on-alternate-channel scenarios (e.g. ApplicationCertificateRotationRehandshakesOpenManagedChannelsAsync, ReconnectJWTAsync, ReconnectSessionOnAlternateChannelAsync). Keep only the StandardServer.cs null-guard from #3844, which is the actual race-condition fix.

…3846) # Description Fixes a null reference exception that occurs when a session expires between `CreateSession` and `ActivateSession` requests. The issue stems from a race condition where the server doesn't properly validate session existence during activation when the session has already timed out. The fix is a minimal, targeted change in `StandardServer.ActivateSessionAsync`: a null-coalescing throw ensures the session exists after lookup, returning `BadSessionIdInvalid` if it has expired. Example flow that previously failed: ```csharp // Session created successfully var createResp = await client.CreateSessionAsync(...); // Session expires before activation await Task.Delay(sessionTimeout); // Previously: NRE from null session // Now: BadSessionIdInvalid returned correctly var activateResp = await client.ActivateSessionAsync(...); ``` ## Note on scope Earlier revisions of this port also modified `SessionManager.ValidateRequestAsync` (removing `ActivateSession` from the early-return bypass) and `Session.ValidateRequest` (allowing `ActivateSession` on non-activated sessions). These changes were reverted because they cause the secure channel id check in `Session.ValidateRequest` to run on reactivation, breaking valid OPC UA reconnect-on-alternate-channel scenarios — the same regression flagged in the source PR #3844. Symptoms included `BadSecureChannelIdInvalid` failures in tests such as `ApplicationCertificateRotationRehandshakesOpenManagedChannelsAsync`, `ReconnectJWTAsync`, and `ReconnectSessionOnAlternateChannelAsync`. ## Related Issues Ports the fix from PR #3844 which addressed this issue on the master378 branch. ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [x] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [x] I have addressed **all** PR feedback received. --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Marc Schier <[email protected]> Co-authored-by: Marc Schier <[email protected]>

Copilot AI mentioned this pull request Jun 5, 2026

[WIP] Fix NRE in activate session if session times out before activation #3845

Closed

Fix NRE in activate Session if Session times out before activate was …

f5ac459

…done Update ClientLastActiveTIme in activate session

Copilot AI added a commit that referenced this pull request Jun 5, 2026

Port fixes from PR #3844 to master: Fix NRE in ActivateSession when s…

85f598c

…ession expires before activation

Copilot AI mentioned this pull request Jun 5, 2026

Port session activation race condition fix from master378 to master #3846

Merged

7 tasks

marcschier approved these changes Jun 5, 2026

View reviewed changes

Copilot started work on behalf of romanett June 5, 2026 10:02 View session

Fix CI failures: revert SessionManager/Session changes that broke rec…

18d5303

…onnect-on-alternate-channel

Copilot AI changed the title ~~[Server] Fix NRE in activate Session if Session times out before activate was done & Update ClientLastActiveTIme in activate session~~ [Server] Fix NRE in ActivateSession if Session times out before activation completes Jun 5, 2026

Copilot finished work on behalf of romanett June 5, 2026 10:12

romanett marked this pull request as draft June 5, 2026 11:11

marcschier added the 1.5.378 Only affects 1.5.378 (pre 2.0) label Jun 9, 2026

romanett mentioned this pull request Jun 18, 2026

Prepare 1.5.378 maintenence release #3893

Merged

7 tasks

Merge branch 'master378' into romanett/fixSession

6b1ba92

romanett marked this pull request as ready for review June 21, 2026 09:32

romanett merged commit fa9364c into master378 Jun 21, 2026
51 of 92 checks passed

romanett deleted the romanett/fixSession branch June 21, 2026 10:43

dependabot Bot mentioned this pull request Jul 22, 2026

Bump the opcfoundation group with 11 updates OPCFoundation/UA-.NETStandard-Samples#710

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Server] Fix NRE in ActivateSession if Session times out before activation completes#3844

[Server] Fix NRE in ActivateSession if Session times out before activation completes#3844
romanett merged 3 commits into
master378from
romanett/fixSession

romanett commented Jun 5, 2026 •

edited by Copilot AI

Loading

Uh oh!

codecov Bot commented Jun 5, 2026 •

edited

Loading

Uh oh!

romanett commented Jun 5, 2026

Uh oh!

Copilot AI commented Jun 5, 2026

Uh oh!

romanett commented Jun 5, 2026

Uh oh!

CLAassistant commented Jun 5, 2026

Uh oh!

Copilot AI commented Jun 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

romanett commented Jun 5, 2026 • edited by Copilot AI Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

Related Issues

Types of changes

Checklist

Further comments

Uh oh!

codecov Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

romanett commented Jun 5, 2026

Uh oh!

Copilot AI commented Jun 5, 2026

Uh oh!

romanett commented Jun 5, 2026

Uh oh!

CLAassistant commented Jun 5, 2026

Uh oh!

Copilot AI commented Jun 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

romanett commented Jun 5, 2026 •

edited by Copilot AI

Loading

codecov Bot commented Jun 5, 2026 •

edited

Loading