English 中文(简体)
Tomcat为每一项请求设立新的会议
原标题:Tomcat create a new session for every request

我现在就该问题工作了2天,我希望在座的任何人都存在同样的问题和解决办法。

The problem: It s a Spring MVC (2.5.6.) Web Application, which runs in Tomcat 6. When the start page is requested it redirects the customer to a JSP Page (by using HTML s meta refresh tags) which loads it s content with a lot of Ajax requests (Framework: Prototype). The problem is that Tomcat creates a new session for every AJAX requests (about 67 sessions). My first thought was that the Session Cookie is stored after the start page is loaded and the Ajax requests forces the Tomcat to create a new session. My approach was to create the session cookie by hand, but this did not make any difference. The funny thing is that it works in some other tomcat instances, but not in the desired environment for the integration tests. In my opinion it s a Tomcat configuration issue.

在对Pebug进行进一步调查后,我发现,即使向它移交了适当的共同愿景(50B5EA0BCFE811C744CE9C1F9EDE0097),Tocat也为每一项请求设立了新的会议:

Request Header 1: 
Cookie JSESSIONID=F3206CBF2C961E125821FF22FA31A02D

Response Header 1:
Set-Cookie JSESSIONID=49E000B4D6880F4F94531AB9C78DB667; Path=/JOCA-Music-Portal   JSESSIONID=50B5EA0BCFE811C744CE9C1F9EDE0097; Path=/JOCA-Music-Portal

Request Header 2:
Cookie JSESSIONID=50B5EA0BCFE811C744CE9C1F9EDE0097

Response Header 2:
Set-Cookie JSESSIONID=DCCA2D1B98D11223A6B8855800276E27; Path=/JOCA-Music-Portal

UPDATE: Further investigation isolated the problem to the Tomcat Realm configuration. We use a JDBC Realm for login. When the login is deativated, only one Session is created. If it s activated, Tomcat creates invalidated/expired sessions, that s why a new session is created with each request. But why does Tomcat behave like this?

我确实绝望,因此,任何思想/想法/解决办法都受到高度赞赏。

非常感谢

问题回答

我们最近带着我们正在发展的希望,陷入了同一个问题。 要查明,问题在于修改Tomcat,以帮助防止届会固定袭击。 缺席,在认证的基础上设立了一个新的会议。 这始于6.0.21。 详细分析背景组合方案变化情况(原子目录/频率/问题:)。

我们遇到了同样的问题,但在使用习俗ERERNALSSO认证时。 解决办法是明确将其从org.apache.catalina.authenticator.AuthenticatorBase继承本类的构造中删除:

super.setChangeSessionIdOnAuthentication(false);




相关问题
why the session in iis automatically log out?

I used iis6, and when i called a function Directory.delete(), the all the session relate this website will be logged out. and i debugged the website, i found no exception. any one have ideas on this ? ...

Check session from a view in CodeIgniter

What is the best way to check session from a view in CodeIgniter, it shows no way in their user guide, otherwise I will have to make two views on everything, which is kinda weird...still a newbie to ...

Can I get the size of a Session object in bytes in c#?

Is it possible to get the size(in bytes) of a Session object after storing something such as a datatable inside it? I want to get the size of a particular Session object, such as Session["table1"], ...

提供严格分类的出席会议物体

提供严格分类的与会机会的最佳方式是什么? 我正计划转而选择矩阵,这正在促使汇编者抱怨我的幻觉方案拟订方法......

PHP Session is not destroying after user logout

I m trying to create an authentication mechanism for my PHP Application and I m having difficulty destroying the session. I ve tried unsetting the authentication token which was previously set within ...

热门标签