java Apache Tomcat 7 在每个请求上更改 JSESSIONID
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/14466595/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Apache Tomcat 7 Changing JSESSIONID on Every Request
提问by Nobody
This issue is driving me insane, so maybe someone could help me understand what the issue is. I have a tomcat web application being fronted by HAProxy. HAProxy is also doing SSL offloading, and is configured to use sticky sessions. I am using Tomcat's session replication feature which seems to be working just fine. The sessions appear on both appservers.
这个问题让我发疯，所以也许有人可以帮助我理解问题是什么。我有一个以 HAProxy 为前端的 tomcat Web 应用程序。HAProxy 还进行 SSL 卸载，并配置为使用粘性会话。我正在使用 Tomcat 的会话复制功能，该功能似乎运行良好。会话出现在两个应用程序服务器上。
For some reason, Tomcat is generating a new JSESSIONID for every single web request, and then copying the contents of the old session into the new session. That is to say, my session contents are still there within the new session, but a new ID is generated and sent back to the client. But it only does this for my web application. It does not do this for the /manager application.
出于某种原因，Tomcat 会为每个 Web 请求生成一个新的 JSESSIONID，然后将旧会话的内容复制到新会话中。也就是说，我的会话内容仍然在新会话中，但生成了一个新的 ID 并发送回客户端。但这仅适用于我的 Web 应用程序。它不会为 /manager 应用程序执行此操作。
I have tried every trick in the book, such as setting this in my context.xml:
我尝试了书中的所有技巧，例如在我的 context.xml 中设置：
<Valve className="org.apache.catalina.authenticator.BasicAuthenticator" changeSessionIdOnAuthentication="false" />
And setting these attributes on my Context element:
并在我的 Context 元素上设置这些属性：
<Context path="/myapp" reloadable="false" override="true" useNaming="false" allowLinking="true" useHttpOnly="false" sessionCookiePath="/" sessionCookiePathUsesTrailingSlash="false">
And still, the result is the same. Tomcat generates a new session id with every request and copies the contents of the old session into the new id.
然而，结果是一样的。Tomcat 为每个请求生成一个新的会话 ID，并将旧会话的内容复制到新 ID 中。
I would suspect it had something to do with HAProxy, except that the /manager application is also behind HAProxy and it does not exhibit this behavior.
我怀疑它与 HAProxy 有关系，除了 /manager 应用程序也在 HAProxy 后面，它没有表现出这种行为。
Why is Tomcat doing this, and what can I do to prevent it?
为什么 Tomcat 会这样做，我可以做些什么来防止它？
采纳答案by Nobody
Turns out that it was cause by Spring Security. We are using Spring Security 3.1x, and by default it stores the authenticated credentials in the user's session. And to counter session fixation attacks, it automatically copies the contents of the user's session to a new session id and invalidates the old session.
原来这是由 Spring Security 引起的。我们使用的是 Spring Security 3.1x，默认情况下它会将经过身份验证的凭据存储在用户的会话中。并且为了对抗会话固定攻击，它会自动将用户会话的内容复制到新的会话 ID 并使旧会话无效。
The fix was to add the following to the http element in the security configuration, since we don't need to use the session in our application:
修复是将以下内容添加到安全配置中的 http 元素，因为我们不需要在我们的应用程序中使用会话：
create-session="stateless"
Hopefully this helps someone else down the line.
希望这可以帮助其他人。
回答by Patrikoko
I got the same problem with new id session when I refresh page On tomcat7 server, I only add into the context.xml this code :
我在刷新页面时遇到了与 new id session 相同的问题 在 tomcat7 服务器上，我只在 context.xml 中添加了以下代码：
<Valve className="org.apache.catalina.authenticator.BasicAuthenticator" changeSessionIdOnAuthentication="false" />
<Context path="/myapp" reloadable="false" override="true" useNaming="false" allowLinking="true" useHttpOnly="false" sessionCookiePath="/" sessionCookiePathUsesTrailingSlash="false">
This work fine for me.
这对我来说很好。
回答by jcern
Not sure exactly what your problem is, but there are two things I would check. First, did you specify the jvmRoute in tomcat?
不确定您的问题到底是什么，但我要检查两件事。首先，你在tomcat中指定了jvmRoute吗？
Tomcatserver.xml
雄猫server.xml
<Engine name="Catalina" defaultHost="localhost" jvmRoute="machine1">
Haproxy.cfg(references jvmRoute)
Haproxy.cfg（参考jvmRoute）
server machine1 SERVER_IP cookie machine1 check
Tomcat appends the name of the server to the cookie, so not setting that can cause issues.
Tomcat 将服务器的名称附加到 cookie，因此不设置会导致问题。
The other thing to check is to make sure that you added this line to your web.xmlin the web-appsection
要检查的另一件事是确保您将此行添加到您web.xml的web-app部分
<distributable />
