1

When I deploy multiple web apps in my jboss, they all seem to share the same session, Since only one JSESSIONID cookie is created which has path - /, meaning it is accessible from anywhere within the domain. But if you do a session.setAttribute() in one web application, will that attribute be available to other applications(when they use session.getAttribute())?

Ashwin
  • 12,691
  • 31
  • 118
  • 190

2 Answers2

1

As far as I know, each WAR / EAR module will have it's own session by default, so the answer is yes, the session attribute is local, and will not be available in other web applications in the same domain (see session share between different war modules possible in jboss?)

Community
  • 1
  • 1
Eran Medan
  • 44,555
  • 61
  • 184
  • 276
  • Are the session attributes stored in some kind of a database? – Ashwin May 05 '12 at 05:58
  • It's configurable and I think it depends on which app server you are using (not sure if the Servlet spec by itself has any preference on how you persist sessions, but it's worth checking) here is weblogic's configuration options for session persistence, one of them can be JDBC http://docs.oracle.com/cd/E13222_01/wls/docs90/webapp/sessions.html#139726 – Eran Medan May 05 '12 at 19:27
  • I am using jboss server. Where can I find out how jboss stores its session attributes. – Ashwin May 06 '12 at 03:09
  • I'm sure you have seen this question: http://stackoverflow.com/questions/1922048/tomcat-jboss-sessions-where-are-they-usually-stored but if not, it's going to give you a starting point. I would say, either wait for someone who knows to answer, or dig into JBOSS documentation online... (e.g. here http://docs.jboss.org/jbossweb/2.1.x/config/manager.html) – Eran Medan May 07 '12 at 02:52
  • The link (jboss link) contains the answer. Thank you:) – Ashwin May 08 '12 at 05:35
1

session.setAttribute() apply only on the session you setting it's attribute. the reason you see the JSESSIONID cookie on each session is because each web app set it separatly (is it spring security?).

shem
  • 4,686
  • 2
  • 32
  • 43
  • There is only one JSESSIONID cookie set in my browser with the whole domain as it's path. So this cookie goes to all the web applications in the request header. But my question is that if I print the session id in both the web apps, will I get the same ID? – Ashwin May 04 '12 at 14:11
  • I'm almost sure that it'll be different id's. try use [fiddler](http://www.fiddler2.com/fiddler2/) for debug it – shem May 04 '12 at 14:17
  • I will try it out and let you know. – Ashwin May 05 '12 at 04:43
  • @Ashwin: under WebSphere, the `JSESSIONID` is the same in all applications. Under JBoss, the `JSESSIONID` is different for each application. – Julien Kronegg Aug 28 '13 at 11:35