DO NOT REPLY [Bug 34394] New: - Session lost if more than one JSESSIONID exist in the cookie

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=34394>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=34394

           Summary: Session lost if more than one JSESSIONID exist in the
                    cookie
           Product: Tomcat 4
           Version: 4.1.27
          Platform: All
        OS/Version: Windows XP
            Status: NEW
          Severity: blocker
          Priority: P2
         Component: Catalina
        AssignedTo: tomcat-dev@jakarta.apache.org
        ReportedBy: pchan@chanplanet.com


Hi,

Problem I have is that when using IE 6.0.28, I am loosing my session.
Symtoms are.. each time I refresh the jsp page I get a new session ID.

When looking at the headers my jsp page gets from IE, it gets multiple 
JSESSIONID value pairs.
e.g.
cookie : JSESSIONID=A1F4FDB2DCE970FB5350B0B7E3997C72; 
JSESSIONID=284C19AD5ED2498FE7BFECF838EB47A0

to reproduce this ther are two ways, mind you they are not very consistent, 
but usually after a short while you shold get it.

Method 1: Not necessarily happens in real life
usign the test.jsp page, you create another JSESSIONID by either deleteing the 
ID or setting it by clickign the set button. This test may not be valid, but 
it illustrates what IE does when it calls tomcat.

Then each time you refresh this page, you get a new session id adn a new 
session

Method 2: What happenes in real life
using an application that requires two urls, where when you hit the first url, 
it redirects you to a second url. both urls must be a jsp page.
What happens is that IE will send the cookie from teh first url to teh second 
url, then the seoncd jsp page will then not find this session,as it is a 
different site. So it will then send a new id back to IE. IE then appends this 
new id and so you now have 2 JSESSIONID cookies.
Becasue it appends it, Tomcat doesn't see the second cookie and so when it is 
told to refresh or get a new url, it will then create a new session again, adn 
so the cycle begins.


Appendix test.jsp page used for both scenario
<html>

<script>
function getCookie(name)
{
    var dc = document.cookie;
	alert(dc);
    var prefix = wconfig.cname.value + "=";
    var begin = dc.indexOf("; " + prefix);
    if (begin == -1)
    {
        begin = dc.indexOf(prefix);
        if (begin != 0) return null;
    }
    else
    {
        begin += 2;
    }
    var end = document.cookie.indexOf(";", begin);
    if (end == -1)
    {
        end = dc.length;
    }
    alert( unescape(dc.substring(begin + prefix.length, end)));
    return true;
}

function setCookie(name, value, expires, path, domain, secure)
{
    document.cookie= name + "=" + escape(value) +
        ((expires) ? "; expires=" + expires.toGMTString() : "") +
        ((path) ? "; path=" + path : "") +
        ((domain) ? "; domain=" + domain : "") +
        ((secure) ? "; secure" : "");
}
function deleteCookie(name, path, domain)
{
    if (getCookie(name))
    {
        document.cookie = name + "=" + 
            ((path) ? "; path=" + path : "") +
            ((domain) ? "; domain=" + domain : "") +
            "; expires=Thu, 01-Jan-70 00:00:01 GMT";
    }
}
</script>
<body>
<%

System.out.println(" ****************************site index Headers 
*****************");
			System.out.println("*************************** 
Session " + session.getId());
			for (java.util.Enumeration e = request.getHeaderNames
() ; e.hasMoreElements() ;) 
			{
				String headername = (String) e.nextElement();
		        System.out.println(headername + " : " + 
request.getHeader(headername));
		    }

%>
<%= session.getId() %>
<form name="wconfig">
<input type="text" name="cname" value="JSESSIONID"/>
<input type="button" name="view" onClick="getCookie()"/><br>

<input type="text" name="cvalue" value="<%= session.getId() %>" />
<input type="button" name="view" onClick="setCookie(wconfig.cname.value, 
wconfig.cvalue.value)" value="set"/>

<input type="button" name="view" onClick="deleteCookie(wconfig.cname.value)" 
value="del"/>

</form>
<a href="test.jsp">goto</a>
</body>
</html>

redirct page to place in jsp

<html>
<% newURL = http://blah.com/test.jsp %>
<META HTTP-EQUIV="Refresh"
      CONTENT="0; URL=<%= newURL %>" />
<head>
</head>      
<body>
If this page does take you to teh Administration page please click on the this 
link <a href="<%= newURL%>">Go to site</a>
</body>
</html>

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org