Session Management in Tomcat

Question

Hi,

I have developed a simple web-app with 2 servlets A and B.

I have a few doubts related to session management for the web-app by Tomcat.

NOTE - I have disabled cookies in my web-browser (Chrome) while accessing the web-app.

1.) When the web-app is first hit, Servlet A gets invoked. Servlet A accesses the session from the request and does a simple sysout of the session hashcode. It then does a sendRedirect to servlet B.

[According to my understanding, since this is the first request, Tomcat will send a cookie containing the new session ID back to the browser. However, since we have not "encoded" the redirect URL using HttpResponse.encodeRedirectURL(), the redirect URL will not contain the session ID appended to it. Please correct me if I am wrong here.]

2.) Since cookies are disabled in my browser, it'll ignore the session ID sent back in the cookie and issue a new request to the redirect URL (which also does not have the session ID appended to it).

3.) The new request causes servlet B to be invoked, whoch also accesses the request session and does a sysout of the session hashcode.

What perplexes me is that both Servlets A and B output the same session hashcode, which means that they get the same session from both requests.

How does the second request from the browser map to the same session as before, even though no session ID has been sent ?

Thanks !

Answer 1

There are only 2 ways to pass sessions between requests: Cookie and URL rewrite. If you don't see the session ID in the URL, it must be cookies.

Are you sure the cookie is disabled? It should be easy to see from a HTTP header trace.

Answer 2

Are you certain you've disabled "in memory" cookies? Often browsers will let you disable persistent cookies which are saved to disk, but they'll still allow the transient in memory cookies which only stay resident during a browser session.

I recommend Wireshark for analyzing the HTTP stream. That way you can see the cookies that are sent and received by your browser.

Answer 3

This is strange.

When I tested the application yesterday, it was exhibiting a behaviour similar to what I have described. However, as I test the application now, it behaves perfectly, as I expect it to.

The cause could probably be that I did not restart my browser session after disabling cookies.

Will let you guys know if I experience the same behaviour again.

Thanks for your time guys !