jsp session problem when proxy passing 1

[connectionscentres]

ok, we've written a nice little jsp webapp and got it deployed on tomcat 5.5 on a development machine. It works great and loads fine on

http://localhost:8080/apname/

When it comes to deploying it online it has to go on another machine which will host it with tomcat installed (exact same version). It has happily been deployed and is accessible via

http://servername:8080/apname/

We own a domain

http://www.ourdomain.com

and are planning on redirecting people going to apname.ourdomain.com to the IP address of the tomcat web app. However we are reluctant to expose the server where tomcat is installed directly to the internet. Therefore we have apname.ourdomain.com directing users to

http://differentmachine/apname/

which in turn proxy passes any request for the directory tree to the relevant directory on i.e.

http://servername:8080/apname/

.

When you go to the URL

http://differentmachine/apname/

it loads up our webapp's login screen. You can log in successfully and it is performing database lookups ok which seems to suggest tomcat is working. However, as soon as you are logged in it immediately forgets the session attributes. So whatever info you store as a session.setAttribute is lost. This is the case throughout the application when accessed via this new address.

So the question is, why does it work ok for

http://servername:8080/apname/

but not so well for

http://differentmachine/apname/

In theory it should. Maybe??

Any help would really be appreciated.

 

[sedj]

Session data is based upon a cookie left on the browser. But if your request.getRemoteAddr() gives up your proxy as the client address, then it cannot store the session id on the client - hence no session data. Is this what is happening ?

Click here to learn Ways to help with Tsunami Relief
--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[connectionscentres]

I guess so - I didnt realise session data was stored on the client - I just assumed it was stored on the host machine with tomcat, as the book i'm reading refers to them as session "objects" implying that they are dealt with in java.

Thanks for the help!!!- you've given me a good starting point for further investigation.

 

[sedj]

Each HttpSession object is indeed stored on the server (inside the memory heap of the JVM running Tomcat), but there has to some way of tying this to a client - and this is using a cookie (on browsers that won't accept cookie url-rewriting is done). Else, how would several browsers from one IP have different sessions ?

Click here to learn Ways to help with Tsunami Relief
--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[rj2046]

I'm a novice but I have been reading on this topic recently in the O'Reilly Java Server Pages book which I bought based on a recommendation on this board.

Page 142 specifically states that when using URL rewriting, all pages that reference other pages in the application must be JSP pages or the server will lose track of the session.

URL rewriting sounds like the method of choice to avoid problems with clients who have dis-abled cookies.

 

[sedj]

Well thats fine for client browsers that do not have cookies diabled, but what about the ones that do ? I'm not sure how, or if you can, tell Tomcat to always use URL rewriting ... I would be interested to see what IP request.getRemoteAddr() returns - the browser or the proxy ...

Click here to learn Ways to help with Tsunami Relief
--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[connectionscentres]

You're right, it returns the IP of the proxy not the browser. So- in this case do you think URL rewriting would work?

 

[sedj]

As I said before, I'm really not sure how you would get tomcat to always use URL rewriting - you may have to look at the source, and see if its possible.

I think your best solution is to (like most people) stick your web server in the DMZ ...

Click here to learn Ways to help with Tsunami Relief
--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[connectionscentres]

Problem:
I've tried setting up URL rewriting by inserting

<DefaultContext cookies='false' />

into the Host element of the server.xml file.

Tomcat restarts successfully but urls do not contain any extra parameters. So I then wrote a jsp containing the following

Integer num = new Integer(100);
session.putValue("num",num);
String url = response.encodeURL("

http://www.mydomain.com");

out.println(url);

but the original URL is outputted. Does this mean I havent set up URL rewriting correctly?

 

[connectionscentres]

sorry, posted before reading your message. I think you're right and that's probably what I'll do.