You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Greg Huber <gr...@gmail.com> on 2025/04/09 11:22:01 UTC
9.0.102 sessions
Hello,
I have noticed that seems I have alot of sessions open, when looking in
the application manager. It was was 800+. I don't remember seeing it
this high before. If I refresh the screen I can see the number going up
slowly. I have not made any changes on my app that would cause this.
I have reset it 10 minutes ago, and its now at 350.
Does this sound OK?
Cheers Greg
Re: 9.0.102 sessions
Posted by Greg Huber <gr...@gmail.com>.
Thanks for the curl check.
This is what I get from the default page (from the server)
curl -vv http://www.myapp.co.uk/
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to www.myapp.co.uk (127.0.0.1) port 80 (#0)
> GET / HTTP/1.1
> Host: www.myapp.co.uk
> User-Agent: curl/7.61.1
> Accept: */*
>
< HTTP/1.1 302 302
< Date: Wed, 09 Apr 2025 18:30:24 GMT
< Server: Apache
< Location: /main/
< Content-Length: 0
< Content-Type: text/html;charset=UTF-8
<
* Connection #0 to host www.myapp.co.uk left intact
I can use this now to narrow down which pages from the logs are creating
the sessions.
I will also look at your suggestions on the valve and session time out.
Many thanks.
On 09/04/2025 19:29, Christopher Schultz wrote:
> Greg,
>
> On 4/9/25 7:22 AM, Greg Huber wrote:
>> I have noticed that seems I have alot of sessions open, when looking
>> in the application manager. It was was 800+. I don't remember
>> seeing it this high before. If I refresh the screen I can see the
>> number going up slowly. I have not made any changes on my app that
>> would cause this.
>>
>> I have reset it 10 minutes ago, and its now at 350.
>>
>> Does this sound OK?
>
> Maybe?
>
> What happens when you hit the root of your web application? Do you
> have any component that creates a session?
>
> You can probably check easily like this:
>
> $ curl -vv https://yoursite/yourapp/
>
> If the response includes a Set-Cookie: JSESSIONID=... header than
> anybody coming by your application will create a session.
>
> If you use the default 30-minute session inactivity timeout, that
> means any casual passer-by, web crawler, or potential attacker can
> create as many sessions as they want.
>
> You might want to look at using the crawler session manager valve[1].
> You may also want to reduce the default inactivity timeout for your
> sessions from 30 minutes to something shorter, then raise the timeout
> for each session after authentication. That way, these trivial
> sessions will time out more quickly.
>
> -chris
>
> [1]
> https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#Crawler_Session_Manager_Valve
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: 9.0.102 sessions
Posted by Mark Thomas <ma...@apache.org>.
On 10/04/2025 10:44, Greg Huber wrote:
> Hello,
>
> Going through the logs, the session creation was being triggered from
> our 403 jsp page (they were not following the robots.txt and got
> themselves banned).
>
> 10 minutes of log entries: (752 403's)
>
> 752 (32.71%) 0 (00.00%) 1.5 MiB (04.64%) 403 - Forbidden:
> Server is refusing to respond to it
>
> ####
>
> Its been a long time since I looked at this, does adding session false
> on the 403 page directive seem a good solution?
Yes.
> <%@ page language="java" contentType="text/html; charset=UTF-8"
> session="false" %>
>
> I have tested it and it does stop the creation/incrementing.
Great. Tx for providing feedback on the root cause of the problem.
Mark
>
> Cheers Greg
>
> On 09/04/2025 19:29, Christopher Schultz wrote:
>> Greg,
>>
>> On 4/9/25 7:22 AM, Greg Huber wrote:
>>> I have noticed that seems I have alot of sessions open, when looking
>>> in the application manager. It was was 800+. I don't remember
>>> seeing it this high before. If I refresh the screen I can see the
>>> number going up slowly. I have not made any changes on my app that
>>> would cause this.
>>>
>>> I have reset it 10 minutes ago, and its now at 350.
>>>
>>> Does this sound OK?
>>
>> Maybe?
>>
>> What happens when you hit the root of your web application? Do you
>> have any component that creates a session?
>>
>> You can probably check easily like this:
>>
>> $ curl -vv https://yoursite/yourapp/
>>
>> If the response includes a Set-Cookie: JSESSIONID=... header than
>> anybody coming by your application will create a session.
>>
>> If you use the default 30-minute session inactivity timeout, that
>> means any casual passer-by, web crawler, or potential attacker can
>> create as many sessions as they want.
>>
>> You might want to look at using the crawler session manager valve[1].
>> You may also want to reduce the default inactivity timeout for your
>> sessions from 30 minutes to something shorter, then raise the timeout
>> for each session after authentication. That way, these trivial
>> sessions will time out more quickly.
>>
>> -chris
>>
>> [1] https://tomcat.apache.org/tomcat-9.0-doc/config/
>> valve.html#Crawler_Session_Manager_Valve
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: 9.0.102 sessions
Posted by Greg Huber <gr...@gmail.com>.
Hello,
Going through the logs, the session creation was being triggered from
our 403 jsp page (they were not following the robots.txt and got
themselves banned).
10 minutes of log entries: (752 403's)
752 (32.71%) 0 (00.00%) 1.5 MiB (04.64%) 403 - Forbidden:
Server is refusing to respond to it
####
Its been a long time since I looked at this, does adding session false
on the 403 page directive seem a good solution?
<%@ page language="java" contentType="text/html; charset=UTF-8"
session="false" %>
I have tested it and it does stop the creation/incrementing.
Cheers Greg
On 09/04/2025 19:29, Christopher Schultz wrote:
> Greg,
>
> On 4/9/25 7:22 AM, Greg Huber wrote:
>> I have noticed that seems I have alot of sessions open, when looking
>> in the application manager. It was was 800+. I don't remember
>> seeing it this high before. If I refresh the screen I can see the
>> number going up slowly. I have not made any changes on my app that
>> would cause this.
>>
>> I have reset it 10 minutes ago, and its now at 350.
>>
>> Does this sound OK?
>
> Maybe?
>
> What happens when you hit the root of your web application? Do you
> have any component that creates a session?
>
> You can probably check easily like this:
>
> $ curl -vv https://yoursite/yourapp/
>
> If the response includes a Set-Cookie: JSESSIONID=... header than
> anybody coming by your application will create a session.
>
> If you use the default 30-minute session inactivity timeout, that
> means any casual passer-by, web crawler, or potential attacker can
> create as many sessions as they want.
>
> You might want to look at using the crawler session manager valve[1].
> You may also want to reduce the default inactivity timeout for your
> sessions from 30 minutes to something shorter, then raise the timeout
> for each session after authentication. That way, these trivial
> sessions will time out more quickly.
>
> -chris
>
> [1]
> https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#Crawler_Session_Manager_Valve
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: 9.0.102 sessions
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Greg,
On 4/9/25 7:22 AM, Greg Huber wrote:
> I have noticed that seems I have alot of sessions open, when looking in
> the application manager. It was was 800+. I don't remember seeing it
> this high before. If I refresh the screen I can see the number going up
> slowly. I have not made any changes on my app that would cause this.
>
> I have reset it 10 minutes ago, and its now at 350.
>
> Does this sound OK?
Maybe?
What happens when you hit the root of your web application? Do you have
any component that creates a session?
You can probably check easily like this:
$ curl -vv https://yoursite/yourapp/
If the response includes a Set-Cookie: JSESSIONID=... header than
anybody coming by your application will create a session.
If you use the default 30-minute session inactivity timeout, that means
any casual passer-by, web crawler, or potential attacker can create as
many sessions as they want.
You might want to look at using the crawler session manager valve[1].
You may also want to reduce the default inactivity timeout for your
sessions from 30 minutes to something shorter, then raise the timeout
for each session after authentication. That way, these trivial sessions
will time out more quickly.
-chris
[1]
https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#Crawler_Session_Manager_Valve
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: 9.0.102 sessions
Posted by Greg Huber <gr...@gmail.com>.
Thanks for the reply.
I have rechecked the manager app and the sessions are around 40, and steady.
I did not notice the link on the number of sessions, and checking now I
can see they are all under 30 minutes, which is good.
I will go through the logs and analyse the urls to see what was
triggering the session creation, normal web crawling should not.
Cheers Greg
On 09/04/2025 12:53, Mark Thomas wrote:
> On 09/04/2025 12:22, Greg Huber wrote:
>> Hello,
>>
>> I have noticed that seems I have alot of sessions open, when looking
>> in the application manager. It was was 800+. I don't remember
>> seeing it this high before.
>
> Before what?
>
>> If I refresh the screen I can see the number going up slowly. I
>> have not made any changes on my app that would cause this.
>>
>> I have reset it 10 minutes ago, and its now at 350.
>
> You can use the Manager app to look at how long a session has been
> inactive. Are any of those beyond the session expiration time and not
> being cleaned up?
>
>> Does this sound OK?
>
> It depends.
>
> Mark
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: 9.0.102 sessions
Posted by Mark Thomas <ma...@apache.org>.
On 09/04/2025 12:22, Greg Huber wrote:
> Hello,
>
> I have noticed that seems I have alot of sessions open, when looking in
> the application manager. It was was 800+. I don't remember seeing it
> this high before.
Before what?
> If I refresh the screen I can see the number going up
> slowly. I have not made any changes on my app that would cause this.
>
> I have reset it 10 minutes ago, and its now at 350.
You can use the Manager app to look at how long a session has been
inactive. Are any of those beyond the session expiration time and not
being cleaned up?
> Does this sound OK?
It depends.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org