Session tracking in tomcat4.0

[Alain Leblanc <al...@rochester.rr.com>]

Not sure this is really tomcat4 related, but here it is.

We recently migrated from Tomcat3.2 to tomcat4 and the session tracking stopped working. We have an application where a user logs in and then accesses different JSP pages and servlet. The login uses SSL and most of the other pages do not.

Now it seems that when I go from a SSL page to a non-SSL page a new session id is created. I actually tested it where in the last SSL pages (call it X.jsp) I have a SSL-link and a non-SSL one to the same pages (call it Y.jsp). In both pages I added a couple of statements to print the session ID and the time the session was created. If I follow a SSL link the session ID are the same in both pages. IBut if I go to Y.jsp from X.jsp without using SSL then the session ID in Y.jsp is different than the session ID in X.jsp, and from the time printed it looks that the session attached to Y.jsp is created just as Y.jsp is accessed.

Is this the normal behavior? Am I not understanding something that should be obvious?

Tomcat4 runs behind Apache1.3 and the pages go through URL rewrite, but I doubt the problem is there.

Thanks,

Alain

Re: Session tracking in tomcat4.0

[Bill Barker <wb...@wilshire.com>]

This is the normal behavior.  What you expect is what happens for all
versions upto and including 3.3.1.  With 3.3.2-dev (and, of course 3.3.2,
when it gets to release :), this is an option (defaulting to the 4.x
behavior of denying switching sessions from https->http).  With TC 4.1.x
(and, AFAIK, TC 5.x), this isn't an option.  It is illegal to switch
sessions from https->http.

"Alain Leblanc" <al...@rochester.rr.com> wrote in message
news:012801c314bc$2771c340$b8874242@BethEtAlain...
Not sure this is really tomcat4 related, but here it is.

We recently migrated from Tomcat3.2 to tomcat4 and the session tracking
stopped working. We have an application where a user logs in and then
accesses different JSP pages and servlet. The login uses SSL and most of the
other pages do not.

Now it seems that when I go from a SSL page to a non-SSL page a new session
id is created. I actually tested it where in the last SSL pages (call it
X.jsp) I have a SSL-link and a non-SSL one to the same pages (call it
Y.jsp). In both pages I added a couple of statements to print the session ID
and the time the session was created. If I follow a SSL link the session ID
are the same in both pages. IBut if I go to Y.jsp from X.jsp without using
SSL then the session ID in Y.jsp is different than the session ID in X.jsp,
and from the time printed it looks that the session attached to Y.jsp is
created just as Y.jsp is accessed.

Is this the normal behavior? Am I not understanding something that should be
obvious?

Tomcat4 runs behind Apache1.3 and the pages go through URL rewrite, but I
doubt the problem is there.

Thanks,

Alain







---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org