You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2006/07/19 10:51:36 UTC
DO NOT REPLY [Bug 40072] New: - New Session Created Randomly in Tomcat 5.0.28
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40072>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40072
Summary: New Session Created Randomly in Tomcat 5.0.28
Product: Tomcat 5
Version: 5.0.28
Platform: Other
OS/Version: Windows 2000
Status: NEW
Severity: critical
Priority: P2
Component: Servlet & JSP API
AssignedTo: tomcat-dev@jakarta.apache.org
ReportedBy: nilesh.j.naik@gmail.com
1. I have a typical JSP-Servlet web application running on tomcat 5.0.28.
2. After successful login a new session is created. (in login.jsp) and user
specific data is kept in session
3. User moves on through the application . Accesses a JSP ( e.g.
PageWithHeavyJavascript.jsp), JavaScript code.
4. After doing some selections etc. PageWithHeavyJavascript.jsp, user
browses another JSP ( e.g. plain.jsp) which *does not* have any session
related code. At this point *sometimes* a NEW session is created. (By
implementing HttpSessionListener I observed that the sessionCreated() methos is
getting called everytime and sessionDestoryed() method is never getting called)
5. After lot of debugging I have observed that this happens when lot of
Javascript code is called through clicks etc. new session is created. I am
unable to link lot of Javascript calls with New session getting created.
I would appreciate if you can shed some light on this issue... any hint/solution?
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40072] - New Session Created Randomly in Tomcat 5.0.28
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40072>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40072
------- Additional Comments From nilesh.j.naik@gmail.com 2006-07-20 06:25 -------
(In reply to comment #1)
> by default jsp's create a session. Its part of the spec.
>
> See <%@ page session='false'%> in the JSP spec for disabling that.
After Login, some information is kept in the session and is used through out
the application. If the JSP is creating a new session by default, i will lose
all the data.
I am facing the session problem while accessing a JSP with heavy JavaScript
Code. In rest of the JSP's with the application, new session is not getting created.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40072] - New Session Created Randomly in Tomcat 5.0.28
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40072>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40072
------- Additional Comments From darryl@darrylmiles.org 2006-07-20 08:56 -------
The session is only created when the session object is access in anyway. I
believe the <%@ page session="false"%> directive tells the JSP layer not to
access a session object in a way to cause one to be created, this is for
contructing the pageContext.
However the HTTP request processing still takes place to match a given cookie
with a valid session object.
So if you pass from code which uses a session (the login part) into code which
codes not use a session, then your browser should still be giving the the
Cookie: header to Tomcat with accessing both URLs.
If Tomcat gets a Cookie it will always try to match it up with a session to
validate it (even if the processing that is to follow doesn't require or touch
the session object after all).
Does your HeavyJavaScript code in anyway access and/or edit the cookies[] in the
page ?
Maybe you can quote the URLs of the post login page and the non-session using
page to confirm if the URLs would be within the same Cookie domain.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40072] - New Session Created Randomly in Tomcat 5.0.28
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40072>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40072
funkman@joedog.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |INVALID
------- Additional Comments From funkman@joedog.org 2006-07-19 10:30 -------
by default jsp's create a session. Its part of the spec.
See <%@ page session='false'%> in the JSP spec for disabling that.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org