You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Arnab Ghosh <gh...@glenwoodsystems.com> on 2010/01/07 17:30:09 UTC
Cross Context Session Creation-
Hello Friends,
I am using a cross context mode in my web application. Suppose there are 3
web conext A , B, C. They will access another web application D through
cross context forwarding. Now I want to know while forwarding a request from
A to D , whether session will go from A to D or a new session will be
created under D.
Also I want to know how many active session I can create under a web
application/context in tomcat??
I am using tomcat 6.x and java 6.
Thanks,
Ghosh
Re: Cross Context Session Creation-
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Arnab,
On 1/8/2010 5:34 AM, Arnab Ghosh wrote:
> Can I disable the session creation in context A and C?
Sure: make sure all your JSPs have session="false" in their headers, and
make sure that you call request.getSession(false) and check for NULL
every time.
If you want to enforce a no-session policy, you could write a
filter/valve that wraps the request and throws an exception instead of
creating a session (i.e. when request.getSession(true) is called, or if
getSession() is called and no session already exists).
> Because in context B
> , a request forwarded from context A should not share with a session with a
> request forwarded from context C in any condition. This is my requirement.
> How can I achieve that??
So, you forward like this:
A -> B, session id from A can be used to create a session in B
C -> B, session id from C cannot be used to create a session in B
If that's the case, and B needs a session, then what?
> Or I can have a unique session Id generator. Id will be unique in all
> context. Is it possible?
If the sessions are not being shared, who cares if they have the same id?
Are you overlapping URI spaces? Don't do that.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAktHrDwACgkQ9CaO5/Lv0PD6mgCdHprBh+dhH/3jSRmd84BzGeBc
hRIAmwZ77zharfv2+VySOc/g166Bfnmo
=7sLr
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Cross Context Session Creation-
Posted by Arnab Ghosh <gh...@glenwoodsystems.com>.
> In that case - suppose a session with a *D52869941C38BC234**
>
> CD9A940429C403A
> > * Id is already present in context B (forwarded from context C ). Now a
> new
> > request with same jsessionID came to context A . Then context A forwarded
> > the request to context B .then will it override the existing session Id.
>
> Nope, both requests would use the same session in context B. The chances
> of this happening are slim to non-existant. Session IDs are generated
> randomly.
>>>>>>>>>>>>>>>>>>>>
Can I disable the session creation in context A and C?? Because in context B
, a request forwarded from context A should not share with a session with a
request forwarded from context C in any condition. This is my requirement.
How can I achieve that??
Or I can have a unique session Id generator. Id will be unique in all
context. is it possible??
Thanks,
Ghosh
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Cross Context Session Creation-
Posted by Mark Thomas <ma...@apache.org>.
On 08/01/2010 09:44, Arnab Ghosh wrote:
> Dear Friends,
>
> In that case - suppose a session with a *D52869941C38BC234**CD9A940429C403A
> * Id is already present in context B (forwarded from context C ). Now a new
> request with same jsessionID came to context A . Then context A forwarded
> the request to context B .then will it override the existing session Id.
Nope, both requests would use the same session in context B. The chances
of this happening are slim to non-existant. Session IDs are generated
randomly.
> I have another question --------------
> If I comment the method - request.getsession(true) , in that case will there
> be any session??
It depends on a number of factors. Simplest way to find out is to try it.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Cross Context Session Creation-
Posted by Arnab Ghosh <gh...@glenwoodsystems.com>.
Dear Friends,
In that case - suppose a session with a *D52869941C38BC234**CD9A940429C403A
* Id is already present in context B (forwarded from context C ). Now a new
request with same jsessionID came to context A . Then context A forwarded
the request to context B .then will it override the existing session Id.
(I don't know whether it is possible or not). I don't know whether two
differenet session belongs to two different context can have a same
sessionId or not??
I have another question --------------
If I comment the method - request.getsession(true) , in that case will there
be any session??
Thanks,
Ghosh
On Fri, Jan 8, 2010 at 2:55 PM, Mark Thomas <ma...@apache.org> wrote:
> On 08/01/2010 07:18, Arnab Ghosh wrote:
> > I found that session created in A and B are different and invisible to
> each
> > other. But the session ID is same. I want to know is there any chance of
> > overriding existing session in context B?? Is it a mere coincidence or is
> > there any logic behind this same session Id scenario??
>
> It is by design. If a session cookie is received but the session does
> not exist a new session is created using the ID from the cookie.
>
> Mark
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Cross Context Session Creation-
Posted by Mark Thomas <ma...@apache.org>.
On 08/01/2010 07:18, Arnab Ghosh wrote:
> I found that session created in A and B are different and invisible to each
> other. But the session ID is same. I want to know is there any chance of
> overriding existing session in context B?? Is it a mere coincidence or is
> there any logic behind this same session Id scenario??
It is by design. If a session cookie is received but the session does
not exist a new session is created using the ID from the cookie.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Cross Context Session Creation-
Posted by Arnab Ghosh <gh...@glenwoodsystems.com>.
Dear Friends,
*>>>To quote from 7.3 of the servlet spec (which you should read):
"HttpSession objects must be scoped at the application (or servlet context)
level. The underlying mechanism, such as the cookie used to establish the
session, can be the same for different contexts, but the object referenced,
including the attributes in that object, must never be shared between
contexts by the container.
"To illustrate this requirement with an example: if a servlet uses the
RequestDispatcher to call a servlet in another Web application, any sessions
created for and visible to the servlet being called must be different from
those visible to the calling servlet."
*
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Actually I have an doubt . I ran a test cycle. I cleared all cookies and
then I sent a request to context A then from there it will forward to
context B. I have added session listener in both context. See the below
result -
I am in a servlet of *context A*
Calling *request.getSession(true);*
Session Created in A ------------>*D52869941C38BC234CD9A940429C403A* (
session listener in context A)
Session ID--------------------------------*D52869941C38BC234CD9A940429C403A*
Forwarding to another servlet *of context B*
session Created in B----->*D52869941C38BC234CD9A940429C403A* ( session
listener in context B)
Request Forwarded
I found that session created in A and B are different and invisible to each
other. But the session ID is same. I want to know is there any chance of
overriding existing session in context B?? Is it a mere coincidence or is
there any logic behind this same session Id scenario??
Thanks,
Ghosh
On Thu, Jan 7, 2010 at 11:50 PM, Caldarale, Charles R <
Chuck.Caldarale@unisys.com> wrote:
> > From: Arnab Ghosh [mailto:ghosh@glenwoodsystems.com]
> > Subject: Cross Context Session Creation-
> >
> > Now I want to know while forwarding a request from A to D ,
> > whether session will go from A to D or a new session will
> > be created under D.
>
> To quote from 7.3 of the servlet spec (which you should read):
>
> "HttpSession objects must be scoped at the application (or servlet context)
> level. The underlying mechanism, such as the cookie used to establish the
> session, can be the same for different contexts, but the object referenced,
> including the attributes in that object, must never be shared between
> contexts by the container.
>
> "To illustrate this requirement with an example: if a servlet uses the
> RequestDispatcher to call a servlet in another Web application, any sessions
> created for and visible to the servlet being called must be different from
> those visible to the calling servlet."
>
> > Also I want to know how many active session I can create under a web
> > application/context in tomcat??
>
> Whatever your heap size allows.
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
> MATERIAL and is thus for use only by the intended recipient. If you received
> this in error, please contact the sender and delete the e-mail and its
> attachments from all computers.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
RE: Cross Context Session Creation-
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Arnab Ghosh [mailto:ghosh@glenwoodsystems.com]
> Subject: Cross Context Session Creation-
>
> Now I want to know while forwarding a request from A to D ,
> whether session will go from A to D or a new session will
> be created under D.
To quote from 7.3 of the servlet spec (which you should read):
"HttpSession objects must be scoped at the application (or servlet context) level. The underlying mechanism, such as the cookie used to establish the session, can be the same for different contexts, but the object referenced, including the attributes in that object, must never be shared between contexts by the container.
"To illustrate this requirement with an example: if a servlet uses the RequestDispatcher to call a servlet in another Web application, any sessions created for and visible to the servlet being called must be different from those visible to the calling servlet."
> Also I want to know how many active session I can create under a web
> application/context in tomcat??
Whatever your heap size allows.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org