LazyInitializationException when accessing lazy association after Hibernate Session.close()
0 reputation · 20 Apr 2024, 21:38 UTC
0 reputation · 20 Apr 2024, 21:38 UTC
The goal is to return entity data from a public REST endpoint without accidentally initializing uninitialized Hibernate proxies or exposing associations outside the transaction that loaded them.
Hibernate throws LazyInitializationException when a lazy association is accessed after its Session is closed. Setting hibernate.enable_lazy_load_no_trans permits loading outside a transaction, but it does not restore transactional isolation and may issue additional SQL unexpectedly. Serializing a managed entity directly in an HTTP response can trigger proxy initialization during serialization, which may cause failures or unintended database reads. Behavior may differ between Hibernate 5.x and 6.x; confirm against the target version.
Should the application rely on hibernate.enable_lazy_load_no_trans to allow post-close access, or is a DTO projection required to control serialization? Does JSON serialization of an entity with uninitialized proxies risk accidental data exposure after the Session is closed?
35275 reputation · 20 Apr 2024, 22:31 UTC
Do not rely on hibernate.enable_lazy_load_no_trans to allow lazy association access after the Hibernate Session is closed. Use a DTO projection (or another explicit fetch strategy) to control what data is serialized for the REST response.
Session.close() throws LazyInitializationException.hibernate.enable_lazy_load_no_trans=true permits lazy loading outside a transaction, but it bypasses transactional isolation, can fire additional SQL unexpectedly, and may expose stale or sensitive data.@EntityGraph that selects exactly those attributes.@Transactional method) and return the resulting DTO list.Which Hibernate version are you targeting (5.x vs 6.x)? If you are on 6.x, the enable_lazy_load_no_trans property is deprecated and should not be used; on 5.x it still works but is discouraged for the reasons above.
Use comments to ask for clarification. Post a solution as an answer.
5,960 reputation · 21 Apr 2024, 01:30 UTC
`hibernate.enable_lazy_load_no_trans` only relaxes lazy loading for an open Session running without a transaction. After `Session.close()`, the entity is detached, so accessing an uninitialized lazy proxy or collection still throws `LazyInitializationException`; the flag cannot reopen the Session or restore isolation.
For REST responses, project to a DTO inside the transaction and fetch only required associations. Serializing a managed entity directly lets the JSON mapper invoke getters after close, risking failure or partial payloads. Hibernate 5.x (`javax.persistence`) and 6.x (`jakarta.persistence`) differ, so verify behavior against the target version.
Practical check: load an entity, commit and close the Session, then access a lazy getter outside the transaction and assert `LazyInitializationException`. Enable SQL logging to confirm no implicit SELECT fires after close.