Method processQuery

src/Server/HTTPHandler.cpp:185–654

void HTTPHandler::processQuery(
    HTTPServerRequest & request,
    HTMLForm & params,
    HTTPServerResponse & response,
    Output & used_output,
    QueryScope & query_scope,
    const ProfileEvents::Event & write_event)
{
    using namespace Poco::Net;

    LOG_TRACE(log, "Request URI: {}", request.getURI());

    if (!authenticateUser(request, params, response))
        return; // '401 Unauthorized' response with 'Negotiate' has been sent at this point.

    /// The user could specify session identifier and session timeout.
    /// It allows to modify settings, create temporary tables and reuse them in subsequent requests.

    String session_id;
    std::chrono::steady_clock::duration session_timeout;
    bool session_is_set = params.has("session_id");
    const auto & config = server.config();

    /// Close http session (if any) after processing the request
    bool close_session = false;
    if (params.getParsed<bool>("close_session", false) && server.config().getBool("enable_http_close_session", true))
        close_session = true;

    if (session_is_set)
    {
        session_id = params.get("session_id");
        if (session_id.empty())
            throw Exception(ErrorCodes::SESSION_ID_EMPTY, "Session id query parameter was provided, but it was empty");
        session_timeout = parseSessionTimeout(config, params);
        std::string session_check = params.get("session_check", "");
        session->makeSessionContext(session_id, session_timeout, session_check == "1");
    }
    else
    {
        session_id = "";
        /// We should create it even if we don't have a session_id
        session->makeSessionContext();
    }

    /// We need to have both releasing/closing a session here and below. The problem with having it only as a SCOPE_EXIT
    /// is that it will be invoked after finalizing the buffer in the end of processQuery, and that technically means that
    /// the client has received all the data, but the session is not released yet. And it can (and sometimes does) happen
    /// that we'll try to acquire the same session in another request before releasing the session here, and the session for
    /// the following request will be technically locked, while it shouldn't be.
    /// Also, SCOPE_EXIT is still needed to release a session in case of any exception. If the exception occurs at some point
    /// after releasing the session below, this whole call will be no-op (due to named_session being nullptr already inside a session).
    SCOPE_EXIT_SAFE({ releaseOrCloseSession(session_id, close_session); });

    auto context = session->makeQueryContext();

    auto roles = params.getAll("role");
    if (!roles.empty())
        context->setCurrentRoles(roles);