I have an Java Http Servlet and trying to store things into the session. I have checked the request header and the same JSESSIONID is being sent each request.
However, every time, the session object (id) is different AND it contains none of the properties that we set in the last request.
More details: This works fine with just Tomcat7, but when I try to use nginx as a frontloader, the cookie is still sent, but the session object is still different.
Looks like the request URL is a fully-qualified domain.
Any ideas on what would be causing this or how to debug?
Thanks!
Related
In java, JSESSIONID has a value with following format:
JSESSIONID=UvDBSG6PjxsVMyDo0x5NDkM9ou.server_name
But, I want to use JSESSIONID value without server name like with this format.
JSESSIONID=UvDBSG6PjxsVMyDo0x5NDkM9ou
So, I had extended HttpSession and HttpServletRequestWrapper for create JSESSIONID that like with above mentioned format.
It is responded correctly at first time. But, if client(browser) try access to a resource(css, img, js and other web resource file. except servlet request), server response the JSESSIONID that include server name like with origin format.
Why this situation is happened?
Is it possible to intercept request that access to resource?
Or is it possible to configure JSESSIONID without server name?
While using response.sendredirect session lost the value in https protocol, how to resolve this issue in java
Your recent edit does not help more than original post
Not only one case would cause this problem, one possible would be session tracking issue, if it's cookie(by default) check the cookies once you login.
Another one would be because of path session cookie configs, check for cookie path, domain attributes.
Also note in filter or generally anywhere you either redirect or forward a request you cannot do anything with the request and you must consider the request done, best practice would be return the method just after the redirect or forward.
Here's my situation, I have a web site that I just load using Apache HTTPD that then makes Ajax POST requests to a servlet which returns only JSON data. That JSON data is then used to update tables, etc..
Now I want to add user logic to my site, and also maintain servlet sessions for requests made by individual users.
I understand that the servlet needs to return the session id generated by the first call to request.getSession(), so that the client can add this sessionid to future Ajax requests in order for the servlet to know which session in memory to use.
I also understand that the two ways that this session id can be returned to the client is either using cookies (JESSIONID) or URL Rewriting.
If I can't use URL Rewriting, because I'm just returning JSON data, are cookies the only way I have left to send back the session id to the client?
Also, as a side question, currently I noticed that there is no JSESSIONID cookie in any of my HTTP responses from the servlet. Someone suggested to me that this was something new in Tomcat7 and that I had to activate them in the global context.xml. Does this mean that by default there is no session handling even if you make calls to request.getSession() ?
You have correctly identified two of the three ways of handling session IDs supported by Tomcat. There is a third way to track sessions but only if the application runs over SSL. In that case you can configure Tomcat to use the SSL session ID.
If the Servlet calls request.getSession() then Tomcat always includes a session ID in the response. However, those cookies are marked as httpOnly by default in Tomcat 7 onwards which means they are not visible to javascript (to protect against XSS attacks that try to steal the cookie). If the session cookies need to be visible to script then you need to set useHttpOnly="false" in either the web application's context.xml (to change the default for just that file) or in $CATALINA_BASE/conf/context.xml to change the default setting for every web application.
I want to keep the jsessionid parameter out of the URLs generated by Struts, but can't seem to find a configuration parameter or similar. To be honest, I don't even know exactly at which level this is handled.
Specifically, Struts (or the servlet engine) puts a sessionid in the URL when it's redirecting with a 302 and the session has not been established before (i. e. the redirect is in response to a request that sent no Cookie header). The response also contains a Set-Cookie header.
Generally, I just don't want the session id in the URL, ever. No cookies, no session.
You can try to check what's your servlet container offers to solve this problem. Alternatively you can write a filter to get rid of jsessionid. Hae a look here for details: http://seamframework.org/Documentation/RemovingJSESSIONIDFromYourURLsAndFixingScache
I'm having a strange issue with cookie visibility between an authentication servlet and our actual jsp. We're using a servlet to authenticate that the user is a valid user, and if they are, we go ahead and add a cookie to the HttpServletResponse with their referer url (this is so that integrations can be redirected to their own login page on logout). Logout operations go through the same servlet, and the cookie is retrieved, and the user directed back to the stored cookie url. This all works.
However, within my site, if I print out the cookies pulled through the pageContext.getRequest().getCookies() [Or through firebug's console] I do not find the cookie I stored at all. There's literally no trace of it. Yet, when you click the logout link, and are directed back to the authentication servlet, the cookie is found, and the redirect followed accordingly.
The thing is, I need to handle timeout operations in the same ways as logouts, but the timeout check is external to the servlet, in a jsp tag. Since the timeout can't find the cookie, it's just using the standard timout page, which the integrating customer wouldn't want to see.
Any ideas what's going on here?
[ANSWER]
It turned out to be a path issue. I know I didn't paste any code, but I was creating the cookie without setting a path, so the cookie was only visible within the servlet directory. Once I set a path of "/" the cookie was visible throughout the site.
When you say "within my site", does that mean that your site is deployed on a different (sub) domain? Cookies by default are only visible to host they were set from, meaning cookie that was set from "www.example.com" will not be visible to "other.example.com". You can get around that by explicitly specifying cookie domain to be common for both (e.g. "example.com").
How are you doing this redirect?
RequestDispatcher's forward method takes request and response objects, presumably the ones you were already working with. This means that the request object is the same HttpServletRequest object that you were dealing with in the Servlet.
Actually, it turned out to be a path issue. I know I didn't paste any code, but I was creating the cookie without setting a path, so the cookie was only visible within the servlet directory. Once I set a path of "/" the cookie was visible throughout the site.