Session Id Length in Tomcat

Question

Hi,

We need to change the session ID length gerenated by tomcat. By default it is 32 bytes, unfortunatly we need a session ID length of 20. Looking online I can see the StandardManager seems to manage this which extends PersistanceManager.

Does anyone know if the sessionIdLength can be modified in the tomcat config? If so what files?

An alternative would be to create a custom Manager which simply overrides/sets the sessionidLength. Is this possible? How do you tell tomcat to use the custom manager in the config?

Any help/comments are appreciated,

James

Answer 1

Yes, you can modify the StandardManager via config file. The Manager element can be nested inside any Context.

So, modify whichever config file has your Context. It might be the server.xml located in the conf directory. Or a context.xml located in the META-INF directory of your war file.

To provide a default for the entire server, edit your $CATALINA_HOME/conf/context.xml. Uncomment the Manager line, and add the sessionIdLength attribute.

<Manager sessionIdLength="10" />

Answer 2

Add the sessionIdLength attribute to the element of your Tomcat's context.xml (or wherever you're manager is defined).

Incidentally, the docs say that the default is 16, not 32.