Cookie management problem, how to disable it completely ?

[Riad Souissi <rs...@stc.com.sa>]

Hi,

This is the case (thanks for your patience):

- I have a client using HTTPClient which sends requests to a server
which *always* returns a reply with "Set-Cookie: ssnid=SomeStuffHere".
There is no way for me to have the server not specify a cookie id in the
HTTP reply.
- Note that the HTTPClient is using the MultithreadedConnectionManager,
10 connections are specified as a maximum and the HTTPClient is shared
among 10 threads.
- Note also that between the HTTPClient and the server, there is a load
balancer.
- HTTPClient seems to automatically re-use the Cookie ID in the
HTTPConnection when sending future requests
- The problem is that the Cookie ID which was returned by a previous
request will be reused to send a request to another server, because the
load balancer does round-robin (sticky load balancing on the cookie id
was disabled for performance reasons).
- Because of this, from time to time, the HTTP requests are rejected by
the server because of a wrong or expired Session/Cookie ID.

So I tried this code before executing any PostMethod:

        Cookie[] cookies = httpclient.getState().getCookies();
        if(cookies != null) for(int i=0;i<cookies.length;i++)
cookies[i].setExpiryDate(new Date());

Basically I force the cookie to expire.
It mostly worked. among 2000 requests, 100 or less fail because the
related HTTP request seems to contain a Cookie ID in the header
(thread-safe issue ?)

I changed the setExpiryDate(new Date()) to setExpiryDate(new Date(0))
(in case that was a problem with the current date).
It mostly worked. among 2000 requests, 10 or less fail because the
related HTTP request seems to contain a Cookie ID in the header.

Question:
- Is there a better/safer way to instructing HTTPClient not to use
"Cookie: " in the header ?

Regards,
riad


DiscalimerThe information in this email and in any files transmitted with it,
is intended only for the addressee and may contain confidential and/or privileged material.
Access to this email by anyone else is unauthorized. If you receive this in error,
please contact the sender immediately and delete the material from any computer.
If you are not the intended recipient, any disclosure, copying, distribution or
any action taken or omitted to be taken in reliance on it, is strictly prohibited.
Statement and opinions expressed in this e-mail are those of the sender, and do not
necessarily reflect those of STC.

Re: Cookie management problem, how to disable it completely ?

[Roland Weber <RO...@de.ibm.com>]

Hello Riad,

if the server creates a new session for each request without cookie,
it is not a good idea to send only requests without cookie. You will
create unnecessary memory load on the server.

HttpClient stores the cookies in an HttpState object, as you have
noticed. The trick is to use different HttpState objects for each
(application) thread, so that the server can reuse the session for
each thread, while different threads do not interfere with eachother.

hope that helps,
  Roland





"Riad Souissi" <rs...@stc.com.sa> 
17.01.2005 14:56
Please respond to
"HttpClient User Discussion"


To
"HttpClient User Discussion" <ht...@jakarta.apache.org>
cc

Subject
Cookie management problem, how to disable it completely ?







Hi,


This is the case (thanks for your patience):


- I have a client using HTTPClient which sends requests to a server
which *always* returns a reply with "Set-Cookie: ssnid=SomeStuffHere".
There is no way for me to have the server not specify a cookie id in the
HTTP reply.
- Note that the HTTPClient is using the MultithreadedConnectionManager,
10 connections are specified as a maximum and the HTTPClient is shared
among 10 threads.
- Note also that between the HTTPClient and the server, there is a load
balancer.
- HTTPClient seems to automatically re-use the Cookie ID in the
HTTPConnection when sending future requests
- The problem is that the Cookie ID which was returned by a previous
request will be reused to send a request to another server, because the
load balancer does round-robin (sticky load balancing on the cookie id
was disabled for performance reasons).
- Because of this, from time to time, the HTTP requests are rejected by
the server because of a wrong or expired Session/Cookie ID.


So I tried this code before executing any PostMethod:


        Cookie[] cookies = httpclient.getState().getCookies();
        if(cookies != null) for(int i=0;i<cookies.length;i++)
cookies[i].setExpiryDate(new Date());


Basically I force the cookie to expire.
It mostly worked. among 2000 requests, 100 or less fail because the
related HTTP request seems to contain a Cookie ID in the header
(thread-safe issue ?)


I changed the setExpiryDate(new Date()) to setExpiryDate(new Date(0))
(in case that was a problem with the current date).
It mostly worked. among 2000 requests, 10 or less fail because the
related HTTP request seems to contain a Cookie ID in the header.


Question:
- Is there a better/safer way to instructing HTTPClient not to use
"Cookie: " in the header ?


Regards,
riad


DiscalimerThe information in this email and in any files transmitted with 
it,
is intended only for the addressee and may contain confidential and/or 
privileged material.
Access to this email by anyone else is unauthorized. If you receive this 
in error,
please contact the sender immediately and delete the material from any 
computer.
If you are not the intended recipient, any disclosure, copying, 
distribution or
any action taken or omitted to be taken in reliance on it, is strictly 
prohibited.
Statement and opinions expressed in this e-mail are those of the sender, 
and do not
necessarily reflect those of STC.