10

I have two web Applications. I will login in to one Web Application and will navigate to another by links or redirection from the first Application. Lastly after completing some steps in Application two, I will be redirected to Application one. How can I implement this?

Here Application two is generic, and I will have three instances of Application One, which will interact with Application two.

Please suggest a better approach. I have to use spring and Spring Webflow to implement it.

Digital Lightcraft
  • 455
  • 1
  • 7
  • 31
shankarmbtech
  • 105
  • 1
  • 1
  • 4
  • Use CAS https://en.wikipedia.org/wiki/Central_Authentication_Service where there are several implementations depending on the language. For Spring have you seen this in the documentaiton? http://docs.spring.io/spring-security/site/docs/current/reference/html/cas.html – Bhargav Nanekalva Apr 27 '17 at 05:49

2 Answers2

11

Technically, session between two web application (two different WARs) cannot be shared. This is by design and done for security reasons. I would like to make following comments and suggestions for your problem,

  1. Session are generally tracked using an session ID which is generally stored as a cookie on the browser and Session object on the server side.
  2. This cookie is sent server side every time when you send a request.
  3. A cookie will be sent ONLY to the server where it came from.
  4. So a cookie set by www.mysite.com/app1 will be sent only to www.mysite.com/app1 and not to www.mysite.com/app2.
  5. For you case, for a user sessions to be valid across two application, the browser will need two cookies to be set from app1 and app2.
  6. One way would be, when you login to app1 , using java script, also send a login request to app2. When both these request return successfully, your browser will have session for both the applications (app1 and app2)
  7. Now logout will have its own challenges, when you logout from app1, you also need to logout from app2. Technically this means, you need to clear the cookies set from both of these applications. With little help from java script you can do this.
Santosh
  • 17,667
  • 4
  • 54
  • 79
  • From the Specs(http://tools.ietf.org/html/rfc2109) : The Path attribute specifies the subset of URLs to which this cookie applies. – Santosh Jan 06 '16 at 10:47
  • Also refer to this post: http://stackoverflow.com/questions/1967963/how-to-access-cookie-values-on-different-paths-of-the-same-domain-using-php – Santosh Jan 06 '16 at 10:50
  • 5
    For "session id is shared across all the places of your domain", the path needs to be set as '/'. Thats what PHP must be doing, otherwise cookie handling has nothing to do with any technology (java/php etc.) – Santosh Jan 08 '16 at 12:43
  • Is it not possible to set session cookie for whole domain and don't restrict them to specific paths? – kravemir Sep 14 '17 at 12:23
  • 1
    Yes. Thats possible. All you need to do is to set the session cookie with path as root '\'. – Santosh Sep 18 '17 at 11:23
6

When you have to make a call to app2 from app1, pass all necessary information via the request object (as a request params) then app2 can read and create the session there (perhaps a servlet/filter can be used for this).

you can share a session between the same application (app1 and app1) across machines using clustering.

Anantha Sharma
  • 9,920
  • 4
  • 33
  • 35
  • Thanks for your reply Anantha. I can have two seperate sessions. No need for a single session. Please suggest some idea to implement this one.I have no idea how to implement it. Its like one flow. I am doing some functionality in App1. After that i am going to App2 and doing some other functionality which is continuation of App1 and then returning back to App1 and completing the flow. – shankarmbtech Jan 16 '13 at 10:34
  • Its like going to second app for payment process and coming back to App1 – shankarmbtech Jan 16 '13 at 10:35
  • What you explained is a typical payment process (as you mentioned) the process here would be to pass all necessary info as part of the requests (usually HTTP POST) this will create a session in app2 (which handles the payment and returns)... – Anantha Sharma Jan 16 '13 at 12:51