You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Richard Nduka <ri...@gmail.com> on 2010/05/21 17:06:42 UTC
jsessionid problem
Hi,
I have a few quesations i want to ask about jessionid in tomcat.
1. In our web based application which runs on HTTPS, we have observed that
the jsessionid is being appended to the URL. On close examination, we have
observed that this is being added by tomcat to the url (Handled by the
encodeRedirectURL method in Response.java object in the tomcat sources). Why
does tomcat do this?
2. Is it possible for this to be included in the response headers rather
than in the URL? If possible, how can one go about doing this?
Thanks in advance.
Re: jsessionid problem
Posted by Richard Nduka <ri...@gmail.com>.
Hi Chris,
Thanks for your mail. Actually we were analysing our proxy server logs and
saw that a lot of URLs with jsessionid appended were being cached and this
even includes static files. We saw request for static files like images and
.js files being appended with jsessionid. So i think it happens for more
than a few pages.
Thanks
On Fri, May 21, 2010 at 5:25 PM, Christopher Schultz <
chris@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Richard,
>
> On 5/21/2010 11:45 AM, Richard Nduka wrote:
> > Secondly, we have not disabled cookies. In our context, we have cookies
> set
> > to true and cookie is enabled in the browser. For some reason, tomcat
> still
> > re-writes the URL and includes the jsessionid.
>
> Does this happen to all URLs throughout the application, or only certain
> ones? Is Tomcat also sending Set-Cookie headers to the client? Is the
> client actually sending Cookie headers to the server?
>
> During the first request/response conversation between the client and
> the server, it's often impossible for the server to tell if the client
> can support cookies, and so it does both: Set-Cookie in the response,
> plus, all the URLs are rewritten with the jsessionid parameter appended
> to them.
>
> Once the client sends a second request, the cookie is included and the
> remaining responses do not have URLs rewritten.
>
> If you need to remove that corner case, as well as disable all cookies
> who do not support cookies, you'll have to write a simple filter that
> wraps the response and overrides the encodeURL and encodeRedirectURL
> methods (and their older, misspelled versions, too) so that they return
> unmodified URLs. This may have ... unintended consequences where
> sessions and cookie-less clients are concerned, though.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkv2tBQACgkQ9CaO5/Lv0PDGtACgoRD0PJWBUwRbSydbdRvFCc9u
> /UgAnAhQKVqHQ7V8k1rSIAIIF7Dpf49f
> =sb0u
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: jsessionid problem
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Richard,
On 5/21/2010 11:45 AM, Richard Nduka wrote:
> Secondly, we have not disabled cookies. In our context, we have cookies set
> to true and cookie is enabled in the browser. For some reason, tomcat still
> re-writes the URL and includes the jsessionid.
Does this happen to all URLs throughout the application, or only certain
ones? Is Tomcat also sending Set-Cookie headers to the client? Is the
client actually sending Cookie headers to the server?
During the first request/response conversation between the client and
the server, it's often impossible for the server to tell if the client
can support cookies, and so it does both: Set-Cookie in the response,
plus, all the URLs are rewritten with the jsessionid parameter appended
to them.
Once the client sends a second request, the cookie is included and the
remaining responses do not have URLs rewritten.
If you need to remove that corner case, as well as disable all cookies
who do not support cookies, you'll have to write a simple filter that
wraps the response and overrides the encodeURL and encodeRedirectURL
methods (and their older, misspelled versions, too) so that they return
unmodified URLs. This may have ... unintended consequences where
sessions and cookie-less clients are concerned, though.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkv2tBQACgkQ9CaO5/Lv0PDGtACgoRD0PJWBUwRbSydbdRvFCc9u
/UgAnAhQKVqHQ7V8k1rSIAIIF7Dpf49f
=sb0u
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: jsessionid problem
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Richard,
On 5/21/2010 12:07 PM, Richard Nduka wrote:
> Thanks again for your reply.
>
> 1. We are not using clustering.
>
> 2. I have checked in the locations mentioned and more and cannot see
> anywhere that cookies is disabled.
>
> 3. However what surprises me is the fact that if i change the port to use
> HTTP (8080) then no jsessionid is appended in the URL but if i change to
> HTTPS (8443) then it is appended.
You are probably observing that a (possibly secure-only) cookie already
exists for the secure server and therefore Tomcat already knows that
cookies are supported by the client.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkv20PQACgkQ9CaO5/Lv0PCU/wCgqRngtWcdVkkebqdJenhuIc7s
YrMAoJew6yCd5mTOybTRJAUSPvdYz3El
=HBDq
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: jsessionid problem
Posted by Richard Nduka <ri...@gmail.com>.
Thanks again for your reply.
1. We are not using clustering.
2. I have checked in the locations mentioned and more and cannot see
anywhere that cookies is disabled.
3. However what surprises me is the fact that if i change the port to use
HTTP (8080) then no jsessionid is appended in the URL but if i change to
HTTPS (8443) then it is appended.
Thanks.
On Fri, May 21, 2010 at 4:59 PM, Caldarale, Charles R <
Chuck.Caldarale@unisys.com> wrote:
> > From: Richard Nduka [mailto:richies4all@gmail.com]
> > Subject: Re: jsessionid problem
>
> > First of all, we are not fronting tomcat with any other web server or
> > application server apart from the proxy server (Squid) that seats in
> > front of tomcat.
>
> Are you using clustering?
>
> > Secondly, we have not disabled cookies.
>
> You might want to double check that. You'll need to look in
> conf/context.xml, the webapp's META-INF/context.xml, and
> conf/Catalina/[host]/[appName].xml for starters.
>
> > In our context, we have cookies set to true
>
> Which is the default.
>
> > For some reason, tomcat still re-writes the URL and
> > includes the jsessionid.
> >
> > Tomcat version: 5.5.23
>
> That version is over three years old; you might want to move up to the
> current 5.5.29 and see if the problem persists. A change to jsessionid
> handling did go into 5.5.26, but it appears to deal with incoming jsessionid
> values, not outgoing.
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
> MATERIAL and is thus for use only by the intended recipient. If you received
> this in error, please contact the sender and delete the e-mail and its
> attachments from all computers.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: jsessionid problem
Posted by Mark Thomas <ma...@apache.org>.
On 21/05/2010 17:09, Richard Nduka wrote:
> It is a direct request. Typically, it happens for the first time when a user
> enters the application url in a browser and the login page appears with the
> jsessionid appended in the url.
That is expected. Tomcat doesn't know if the browser supports cookies at
that point so it tries both. Once it knows cookies work, it will drop
the path paramater.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: jsessionid problem
Posted by Richard Nduka <ri...@gmail.com>.
It is a direct request. Typically, it happens for the first time when a user
enters the application url in a browser and the login page appears with the
jsessionid appended in the url.
Thanks.
On Fri, May 21, 2010 at 5:05 PM, Pid <pi...@pidster.com> wrote:
> On 21/05/2010 16:59, Caldarale, Charles R wrote:
> >> From: Richard Nduka [mailto:richies4all@gmail.com]
> >> Subject: Re: jsessionid problem
> >
> >> First of all, we are not fronting tomcat with any other web server or
> >> application server apart from the proxy server (Squid) that seats in
> >> front of tomcat.
> >
> > Are you using clustering?
> >
> >> Secondly, we have not disabled cookies.
> >
> > You might want to double check that. You'll need to look in
> conf/context.xml, the webapp's META-INF/context.xml, and
> conf/Catalina/[host]/[appName].xml for starters.
> >
> >> In our context, we have cookies set to true
> >
> > Which is the default.
> >
> >> For some reason, tomcat still re-writes the URL and
> >> includes the jsessionid.
>
> What kind of client is making the request that is rewritten?
>
> Is the request referred from a link in a page, or is it a direct request?
>
>
> p
>
> >> Tomcat version: 5.5.23
> >
> > That version is over three years old; you might want to move up to the
> current 5.5.29 and see if the problem persists. A change to jsessionid
> handling did go into 5.5.26, but it appears to deal with incoming jsessionid
> values, not outgoing.
> >
> > - Chuck
> >
> >
> > THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
> MATERIAL and is thus for use only by the intended recipient. If you received
> this in error, please contact the sender and delete the e-mail and its
> attachments from all computers.
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: users-help@tomcat.apache.org
> >
>
>
>
Re: jsessionid problem
Posted by Pid <pi...@pidster.com>.
On 21/05/2010 16:59, Caldarale, Charles R wrote:
>> From: Richard Nduka [mailto:richies4all@gmail.com]
>> Subject: Re: jsessionid problem
>
>> First of all, we are not fronting tomcat with any other web server or
>> application server apart from the proxy server (Squid) that seats in
>> front of tomcat.
>
> Are you using clustering?
>
>> Secondly, we have not disabled cookies.
>
> You might want to double check that. You'll need to look in conf/context.xml, the webapp's META-INF/context.xml, and conf/Catalina/[host]/[appName].xml for starters.
>
>> In our context, we have cookies set to true
>
> Which is the default.
>
>> For some reason, tomcat still re-writes the URL and
>> includes the jsessionid.
What kind of client is making the request that is rewritten?
Is the request referred from a link in a page, or is it a direct request?
p
>> Tomcat version: 5.5.23
>
> That version is over three years old; you might want to move up to the current 5.5.29 and see if the problem persists. A change to jsessionid handling did go into 5.5.26, but it appears to deal with incoming jsessionid values, not outgoing.
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
RE: jsessionid problem
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Richard Nduka [mailto:richies4all@gmail.com]
> Subject: Re: jsessionid problem
> First of all, we are not fronting tomcat with any other web server or
> application server apart from the proxy server (Squid) that seats in
> front of tomcat.
Are you using clustering?
> Secondly, we have not disabled cookies.
You might want to double check that. You'll need to look in conf/context.xml, the webapp's META-INF/context.xml, and conf/Catalina/[host]/[appName].xml for starters.
> In our context, we have cookies set to true
Which is the default.
> For some reason, tomcat still re-writes the URL and
> includes the jsessionid.
>
> Tomcat version: 5.5.23
That version is over three years old; you might want to move up to the current 5.5.29 and see if the problem persists. A change to jsessionid handling did go into 5.5.26, but it appears to deal with incoming jsessionid values, not outgoing.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: jsessionid problem
Posted by Richard Nduka <ri...@gmail.com>.
Hi Chuck/Peter,
Thanks guys for your mail.
First of all, we are not fronting tomcat with any other web server or
application server apart from the proxy server (Squid) that seats in front
of tomcat.
Secondly, we have not disabled cookies. In our context, we have cookies set
to true and cookie is enabled in the browser. For some reason, tomcat still
re-writes the URL and includes the jsessionid.
Tomcat version: 5.5.23
Platform: Linux
JDK: 1.6
Thanks.
Richard.
On Fri, May 21, 2010 at 4:27 PM, Peter Crowther <peter.crowther@melandra.com
> wrote:
> On 21 May 2010 16:16, Caldarale, Charles R <Chuck.Caldarale@unisys.com
> >wrote:
>
> > > From: Richard Nduka [mailto:richies4all@gmail.com]
> > > Subject: jsessionid problem
> > >
> > > I have a few quesations i want to ask about jessionid in tomcat.
> >
> > Thanks for asking twice - two minutes apart. A tad impatient, are we?
> >
> > Also too impatient to mention the Tomcat version, JVM you're using,
> > platform you're running on, and whether or not you're front-ending Tomcat
> > with something like httpd or IIS?
> >
>
> *chuckle* The second one of the two had versions appended, Chuck - so there
> was extra information there.
>
> - Peter
>
Re: jsessionid problem
Posted by Peter Crowther <pe...@melandra.com>.
On 21 May 2010 16:16, Caldarale, Charles R <Ch...@unisys.com>wrote:
> > From: Richard Nduka [mailto:richies4all@gmail.com]
> > Subject: jsessionid problem
> >
> > I have a few quesations i want to ask about jessionid in tomcat.
>
> Thanks for asking twice - two minutes apart. A tad impatient, are we?
>
> Also too impatient to mention the Tomcat version, JVM you're using,
> platform you're running on, and whether or not you're front-ending Tomcat
> with something like httpd or IIS?
>
*chuckle* The second one of the two had versions appended, Chuck - so there
was extra information there.
- Peter
RE: jsessionid problem
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Richard Nduka [mailto:richies4all@gmail.com]
> Subject: jsessionid problem
>
> I have a few quesations i want to ask about jessionid in tomcat.
Thanks for asking twice - two minutes apart. A tad impatient, are we?
Also too impatient to mention the Tomcat version, JVM you're using, platform you're running on, and whether or not you're front-ending Tomcat with something like httpd or IIS?
> 1. In our web based application which runs on HTTPS, we
> have observed that the jsessionid is being appended to
> the URL.
So stop disabling cookies, and it won't do that. If the client is refusing to use cookies, there's nothing you can do about it, other than not talk to them. If you have disabled cookies in the <Context> element for your webapp, don't do that.
http://tomcat.apache.org/tomcat-6.0-doc/config/context.html
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: jsessionid problem
Posted by Richard Nduka <ri...@gmail.com>.
Hi,
I have a few quesations i want to ask about jessionid in tomcat.
1. In our web based application which runs on HTTPS, we have observed that
the jsessionid is being appended to the URL. On close examination, we have
observed that this is being added by tomcat to the url (Handled by the
encodeRedirectURL method in Response.java object in the tomcat sources). Why
does tomcat do this?
2. Is it possible for this to be included in the response headers rather
than in the URL? If possible, how can one go about doing this?
Tomcat Version: 5.5.23
Platform: Linux
JDK version: 1.6
Thanks in advance.
Re: jsessionid problem
Posted by Peter Crowther <pe...@melandra.com>.
Richard, there are two ways of maitaining sessions:
1) Using cookies (generally Tomcat's preferred way);
2) Using URL rewriting (generally Tomcat's less preferred way, used where a
client has turned off cookies).
There are no other ways of sending session IDs that are supported by all Web
browsers across all content types, though I could conceive of some extra
ones if you were using AJAX. Remember that the browser has to know to send
the session ID back to the server with the next request; this can only be
done using cookies or some feature of the URL.
All that said, I'm surprised Tomcat isn't using cookies in your case. Have
you turned them off in the browser? Have you turned on the use of URL
rewriting in the webapp's config?
- Peter
On 21 May 2010 16:06, Richard Nduka <ri...@gmail.com> wrote:
> Hi,
>
> I have a few quesations i want to ask about jessionid in tomcat.
>
> 1. In our web based application which runs on HTTPS, we have observed that
> the jsessionid is being appended to the URL. On close examination, we have
> observed that this is being added by tomcat to the url (Handled by the
> encodeRedirectURL method in Response.java object in the tomcat sources).
> Why
> does tomcat do this?
>
> 2. Is it possible for this to be included in the response headers rather
> than in the URL? If possible, how can one go about doing this?
>
> Thanks in advance.
>