Symptoms

High CPU on both K2 nodes caused by Workslist control failing when cookie expires
 

Diagnoses

When a user has a form open with the Worklist control on it and the user leaves the page open and the cookie expires (or the user clears cookies) and then refreshes the Worklist control using the 'refresh' button (i.e. no new cookie is set), the K2 server starts to get bombarded from the client browser.

The worklist of the SmartForms app pool is continuously opened and for each workitem returned, it looks like the worklist is opened again.

This continues until the user closes the form, refreshes the page or the offending IP is blocked in IIS.

In the K2 HostServer logs (with debug logging enabled) we could see a lot of 'OpenWorklist' calls for the SmartForms app pool account. The issue was reproduced by leaving any form with the Worklist Control active and expiring the cookies from another browser window. As soon as the cache got cleared, the CPU would spike and the 'OpenWorklist'' for the service account (and not the user with the form open) would occur. As soon as the browser with the Worklist control is closed, the behavior would stop.
 

Resolution

This issue was logged as a bug and a coldfix was provided. Note that this behavior was so bad because the SmartForms app pool has a large worklist (about 3000 workitems) which made the 'OpenWorklist' call very expensive.