aspose file tools*
The moose likes Web Component Certification (SCWCD/OCPJWCD) and the fly likes same session across browsers Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


Win a copy of EJB 3 in Action this week in the EJB and other Java EE Technologies forum!
JavaRanch » Java Forums » Certification » Web Component Certification (SCWCD/OCPJWCD)
Bookmark "same session across browsers" Watch "same session across browsers" New topic
Author

same session across browsers

Rizwan Mohammad
Ranch Hand

Joined: Sep 02, 2005
Posts: 445
Hi,
I am trying to access one of my applications in websphere server. But I am facing one strange problem here.
Though I open two different instances of browser(not by Ctrl+N or popup) both are using same session.
When I print jsessionid cookie and session id values, both browser instances print different jsessionid cookie values
but with same session id. How can this scenario be possible? With this scenarios, my session values aree getting messed up
from both browsers.
Here i am displaying session id and jsession cookie values from both browsers.

From browser 1:
jsessionid cookie value = 0000APUj7MW7vLTX3SMMeXZgwrf:11c2ij3kd
session.getID() = FYf00DbhZASZXhr4HLSO40K

From browser 2:

jsessionid cookie value = 0000FYf00DbhZASZXhr4HLSO40K:11c2ij3kd
session.getID() = FYf00DbhZASZXhr4HLSO40K


Rizwan
SCJA, SCJP, SCWCD, SCBCD, SCDJWS.
Charles Lyons
Author
Ranch Hand

Joined: Mar 27, 2003
Posts: 836
What browser(s) and container(s) are you using? Have you tried it with different browsers (e.g. IE, Netscape/Mozilla, Opera) to see what happens? If it's not the browser, I can only think your container might use some form of IP-session correlation so the same client (same IP address) always interacts with the same session even across several browser windows.


Charles Lyons (SCJP 1.4, April 2003; SCJP 5, Dec 2006; SCWCD 1.4b, April 2004)
Author of OCEJWCD Study Companion for Oracle Exam 1Z0-899 (ISBN 0955160340 / Amazon Amazon UK )
Rizwan Mohammad
Ranch Hand

Joined: Sep 02, 2005
Posts: 445
Thanks for the information. I am using websphere 6 server and IE.
Do you remember any setting on websphere 6 that changes this behavior?
Charles Lyons
Author
Ranch Hand

Joined: Mar 27, 2003
Posts: 836
I Googled for "Websphere same client same session tracking" and got this:

http://publib.boulder.ibm.com/infocenter/wasinfo/v5r1//index.jsp?topic=/com.ibm.websphere.zseries.doc/info/zseries/ae/rtrb_httpsessprobs.html

See the "Session is shared across multiple browsers on same client machine" section.

According to them it's completely browser dependent but I'm not so sure that's a good enough explanation. If you had different jsessionids, you should be getting different sessions. Each new browser instance (as opposed to window) should start afresh. Perhaps IE (being basically an integral part of the OS) is inconsistent in this respect?

My only other question would be are you sure your pages aren't being cached? It is possible that the first browser is showing you one session ID (presumably from a JSP output or something) and when loading the second you are seeing the same original page pulled from the cache rather than a new, updated, version. You can try refreshing the page several times to make sure any cached version is cleared, or add this to your JSP:which will prevent IE from caching your page.

Please let us know how you get on and if you find a solution (or indeed caching is the problem)...
Rizwan Mohammad
Ranch Hand

Joined: Sep 02, 2005
Posts: 445
Charles,
Thanks for your reply. I think my pages are not getting cached. Anyway i am logging jsession id and session id at server side to debug.
I dont think it is browser dependent as this behaviour works well in my local server. When I run two different browsers and request my local server, I see two different session IDs. It happens only when code is deployed was6 test server(different than the local one with so many applications deployed in that server)
Another thing I noted is that when I open one IE browser and another Mozilla browser, different sessions are getting created.
Another interesting thing is, another application is deployed in same node(was6 server, different jvms for each application) but it works well with two different sessions getting created.
Charles Lyons
Author
Ranch Hand

Joined: Mar 27, 2003
Posts: 836
From that information (that the issue only occurs with Websphere and bizzarly with only one application) I can only conclude there's a configuration option or possibly a bug with that release of Websphere. If different jsessionids are being used, different cookies are being read, so it looks like the browser is doing its part correctly. The only place where this merging of sessions can be occuring is on the server, matching multiple jsessionids to a single session... but then my theory about IP tracking fails because different browsers do in fact create different sessions!

Have you tried to replicate the situation using different instances of Mozilla or Opera for instance, and see if the same session runs across two different instances of those as well? At least that would definitely rule IE out as being the problem, or show you that in fact something bizarre is going on with all the browsers (in which case the server is most likely to blame).
Rizwan Mohammad
Ranch Hand

Joined: Sep 02, 2005
Posts: 445
Going on with my experiments, I would like to tell you one more thing.
When I open 3rd IE browser and submits the request, it submits same jsessionid cookie as second one and all subsequent browsers sends same jsessionid cookie which is resulting in same session.
I think when I open the first browser, it is sending random jsessionid cookie and server is resetting that cookie with new value and sendint it back to IE. And upon next submits with new browsers, browser is sending the new jsessionid(which is different than the one which it sends with first request) and server is treating it as same session. And it continues the same jsessionid cookie values with all new browsers there onwards.

Mozilla also does the same way.. If I open another mozilla browser it opens with already existing session.

I thought IE forgets jsessionid value when it gets closed or with new browser but, it keeps on sending same jsessionid value.
I will check with websphere team with any settings are available on server?
I think when server is setting back jsessionid cookie it should set the cookie such a way that it works for only one IE.
Rizwan Mohammad
Ranch Hand

Joined: Sep 02, 2005
Posts: 445
Hi Charles,
We figured out the problem existed because of websphere server cookie setting. Thanks for your valuable suggestions and information sharing.
kri shan
Ranch Hand

Joined: Apr 08, 2004
Posts: 1368
Hi Rizwan, How you figured out the problem in websphere server cookie setting ?
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: same session across browsers
 
Similar Threads
same session across browsers
Problem with session management
session problem
tomcat session handling
distinguishing 2 browsers in the same session.