0

This is a duplicate of this question, but that question is over 4 years old and doesn't have an accepted answer. I'll offer bounty from this question if it does not get an answer.

In my J2EE web application, I have a Filter called AlwaysCreateSessionFilter. Here is my doFilter method:

public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) {
    if (request instanceof HttpServletRequest) {
        ((HttpServletRequest) request).getSession();
    }
    chain.doFilter(request, response);
}

And in this war's web.xml, I have:

<session-config>
    <session-timeout>30</session-timeout>
    <cookie-config>
        <http-only>true</http-only>
        <secure>true</secure>
    </cookie-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

The browser always correctly includes a JSESSIONID cookie with the value from the server's most recent response (provided in the response's Set-Cookie header). But the problem is that the server always provides a brand new value for JSESSIONID in the Set-Cookie header, not the same one provided with the request. So the server is creating a new session on each request.

I have set a breakpoint in the doFilter method, and can confirm that request.getSession(false) returns a valid session with the correct id that corresponds to the value of the JSESSIONID cookie being provided with the request. It's just that, when the server responds, it always has that Set-Cookie header set to a brand new JSESSIONID, and I can't figure out what is doing it.

Here is crude diagram to illustrate what is happening:

Problem workflow

Any help would be appreciated.

Matt
  • 23,363
  • 39
  • 111
  • 152
  • Do you use other web tools as f5 or cloudeflare which can effect cookie? – Ori Marko Jun 11 '18 at 14:43
  • No, not to my knowledge. But as I stated, the cookie is definitely making it to the server. I can evaluate the `HttpServletRequest` using `request.getCookies()` and see a cookie named `JSESSIONID` with a value that corresponds to the most recent value provided by the server (via the `Set-Cookie` header in the response). @user7294900 Is that not an accurate way to tell that nothing funky is happening with the cookie? – Matt Jun 11 '18 at 14:45
  • Cookie is saved in same path of following request? – Ori Marko Jun 11 '18 at 14:51
  • Added a diagram to address your question – Matt Jun 11 '18 at 15:05

0 Answers0