Apache + Tomcat = no cookies and no session id
When our application is run in an Apache+Tomcat environment session management breaks down completely. Cookies containing session ids are apparently not passed to Tomcat. Url rewriting, the usual solution to no cookies, simply does not work. Encoded URLs do not have jsessionid added.
In searching around I saw lots of references to this problem but no solutions. This problem has been known for at least 5-6 years based on some of the search results I have found so I'm hopeful that there is some sort of 'standard' solution.
Can someone give me the solution or point me to a site deals with this problem.
Thanks,
-=beeky
[656 byte] By [
beekya] at [2007-11-26 15:52:20]
# 2
I'm answering my own question in case someone comes upon this discussion via a search for the same problem.
To reiterate: when an application that was developed using Tomcat was moved to an Apache + Tomcat system, session management quit working. The orginal session management used cookies but url rewriting also did not work.
The basic problem is that Apache is being used as a reverse proxy in this configuration. The application in question is proxied by the following Apache directive:
ProxyPass /alias http://localhost:8082/my_application
The version of Apache in question, 1.3, does not have the capability of re-writing the cookie header so incoming cookies that are associated with the 'alias' context are not associated with the my_application context when Tomcat gets the request from Apache.
The simple solution is to change the ProxyPass directive to eliminate the mapping. This solution worked in my case but may not be possible if it is necessary to map one or more aliases to a single application.
URL rewriting does not work in this situation because Apache does not recognize the ;JSESSIONID= for what it is. Apache considers this to be part of the context name and a 404 will result for any url with a session id in it.
Apparently this can be remedied with a rewrite rule:
<IfModule mod_rewrite.c>
RewriteEngineon
# Force URLs with a jsessionid to go to Tomcat. Necessary because
# Apache doesn't recognise that the semi-colon is special.
RewriteRule^(/.*;jsessionid=.*)$$1 [T=jserv-servlet]
</IfModule>
I have not tried the rewrite rule so you are on your own here.
Apache versions 2.2.x do have the capability to correctly re-write cookie headers via the ProxyPassReverseCookiePath directive.
# 3
hi!
I've a similar problem, but my apache config is different, cause I'm using proxypass in this way:
<IfModule mod_proxy.c>
ProxyPass / ajp://myserver:8009/myapp/
ProxyPassReverse / ajp://myserver:8009/myapp/
</IfModule>
so the cookies are set for /myapp and not for /, so I don't have a session... any idea on how to solve it?
yurja at 2007-7-8 22:12:36 >
