Continuing sessions using JSESSIONID

Question

I have a web application which requires username and password authentication to enter.

What I am doing is, authenticate a user from a stand alone Java app, which would do so by making Http request to the server using username and password. Then I would retrieve JSESSIONID cookie from response of server.

Now what I want is to use this JSESSIONID to continue session on browser i.e. to let user navigate pages of my web app which would be opened by my stand alone java app which I use for authentication.

Is this possible? Or is there any other way to do so.

score 0 · Answer 1 · answered Dec 07 '14 at 04:50

0

Cookie can be changed using below mentioned methods.

        Cookie cookie = new Cookie("JSESSIONID", NEWSESSIONID);
        response.addCookie(cookie);

From your application you can send JSESSIONID as parameter while opening browser first time and reset your cookie using above method either in filter or servlet. This will reset your cookie in client side once you send response back. Next request on wards you will be able to access the session created previously.

answered Dec 07 '14 at 04:50

Nisanth Kumar

56
2

I not sending requests when I access my web app simply browsing it. – Darshan Lila Dec 07 '14 at 05:40
Since you are browsing your application without any details how can we maintain session ?. After authentication are you opening browser from standalone application ? – Nisanth Kumar Dec 07 '14 at 06:03
Yes that's what I want to do. – Darshan Lila Dec 08 '14 at 05:47

score 0 · Answer 2 · answered Feb 10 '15 at 07:20

It's possible but it's not that simple.

Since web applications don't share sessions, what you're looking for is a Single Sign On (SSO) solution, which involves an "Identity Provider" (IdM) that authenticates users for one or more "Service Providers" (SP). In this case, your servlet is the IdM and your web app is an SP.

Depending on your deployment, the following are third-party, open-source SSO libraries that you may be able to use:

Kerberos
PicketLink (for JBOSS)
OpenAM (for Tomcat)

If you don't want to use a third-party library, you may also be able to modify your servlet to be the IdM. Either way, I suggest reading a little about Security Assertion Markup Language (SAML) before deciding on a solution. SAML is a popular method that the above libraries implement.

Continuing sessions using JSESSIONID

2 Answers2