Geek asks and answers

Apache Tomcat 7 Change JSESSIONID for each request

This problem is driving me crazy, so maybe someone can help me understand what the problem is. I have a tomcat web application that issues HAProxy. HAProxy also performs SSL offloading and is configured to use sticky sessions. I am using Tomcat's session replication feature, which seems to be working fine. Sessions are displayed on both application servers.

For some reason, Tomcat generates a new JSESSIONID for each individual web request, and then copies the contents of the old session to a new session. That is, the contents of my session are still present in the new session, but a new identifier is created and sent back to the client. But this is only for my web application. This does not do this for the / manager application.

I tried every trick in the book, such as setting this in my .xml context:

<Valve className="org.apache.catalina.authenticator.BasicAuthenticator" changeSessionIdOnAuthentication="false" />

And setting these attributes to your Context element:

<Context path="/myapp" reloadable="false" override="true" useNaming="false" allowLinking="true" useHttpOnly="false" sessionCookiePath="/" sessionCookiePathUsesTrailingSlash="false">

And still the result will be the same. Tomcat generates a new session identifier with each request and copies the contents of the old session to the new identifier.

I suspect this is due to HAProxy, except that the / manager application is also behind HAProxy and it does not exhibit this behavior.

Why is Tomcat doing this and what can I do to prevent it?

+5
source share
3 answers

, Spring. Spring Security 3.1x, . .

http , :

create-session="stateless"

, - .

+3

id, tomcat7 context.xml :

<Valve className="org.apache.catalina.authenticator.BasicAuthenticator" changeSessionIdOnAuthentication="false" />

<Context path="/myapp" reloadable="false" override="true" useNaming="false" allowLinking="true" useHttpOnly="false" sessionCookiePath="/" sessionCookiePathUsesTrailingSlash="false">

.

+3

Not sure what the problem is, but there are two things that I would check. First, did you specify jvmRoute in tomcat?

Tomcat server.xml

<Engine name="Catalina" defaultHost="localhost" jvmRoute="machine1">

Haproxy.cfg ( jvmRoute links)

server machine1 SERVER_IP cookie machine1 check

Tomcat adds the server name to the cookie, so without specifying what might cause the problems.

Another thing is to make sure that you add this line to yours web.xmlin the sectionweb-app

<distributable />
+1
source

More articles:


All Articles