Session is lost and created as new in every servlet request

Question

I have this big issue. My current session is gone every time I made a new request to Server.

I have checked in a lot of places. I can\'t find what\'s the problem. I

Answer 1

If there is a load balance configuration, will must have to configurate a route in the network for preserve the requests in the same server. Otherwise, the each request will go to a different server, losing the session attribute.

Answer 2

First check if the webapp's context.xml does not have cookies="false" configured.

Further it's good to know that cookies are domain, port and contextpath dependent. If the links in the page points to a different domain, port and/or contextpath as opposed to the current request URL (the one you see in the browser's address bar), then the cookie won't be passed through which will cause that the session cannot be identified anymore and thus you will get a new one from the servletcontainer.

If that is not the cause, then check if you aren't doing a redirect on every request using HttpServletResponse.sendRedirect() for some reason. If you do this already on the very first request, then the cookie will get lost. You'll need to replace

response.sendRedirect(url);

by

response.sendRedirect(response.encodeRedirectURL(url));

Answer 3

One possible cause for this is having a "naked" host name (i.e. one without a domain part). That's fairly common if you're working in an Intranet.

The problem is that almost all browsers cookies will not accept cookies for hostnames without a domain name. That's done in order to prevent evilsite.com from setting a Cookie for com (which would be bad, as it would be the ultimate tracking cookie).

So if you access your applicaton via http://examplehost/ it won't accept any cookie, while for http://examplehost.localdomain/ it will accept (and return) the cookie just fine.

The nasty thing about that is that the server can't distinguish between "the browser got the cookie and ignored it" and "the browser never got the cookie". So each single access will look like a completely new sesson to the server.

Answer 4

In Your properties

  server.session.cookie.http-only=true
  server.session.cookie.secure=true

Remove these settings, it will retain your session id cookie, which is being reset with every request.

Answer 5

Edit your tomcat context.xml file and replace <Context> tag to <Context useHttpOnly="false"> , this helped me.

Answer 6

Try adding the Live Http Headers plugin to firefox, and make sure the session cookie is indeed being passed to the browser from the server, and make sure the browser is sending it back again on the next request.