How to avoid appending -Djboss.node.name value to JSESSIONID

Question

We migrated our application from JBoss 5.1.0 GA to WildFly 8.2.0. I observed that the value of "-Djboss.node.name"(node1) is appending to the JSESSIONID cookie which is causing major problem in my application.

In my application we have a SessionListener class in which we are storing the sessionids to a static map and while doing any operations we are validating the session id from the map and loading the appropriate data.

Please find the below code.

In web.xml
<listener>
  <listener-class>com.project.session.ProjectSessionListener</listener-class>
</listener>

and the code in ProjectSessionListener is

public class ProjectSessionListener extends SeamListener {
private static final Map<String, HttpSession> sessionMap = new HashMap<String, HttpSession>();
...............................
@Override
public void sessionCreated(final HttpSessionEvent event) {
super.sessionCreated(event);
final HttpSession session = event.getSession();
final String sessionId = session.getId();
sessionMap.put(sessionId, session);
 }
}

While adding the sessionid to sessionMap there is no .node1 appended to the session(ABCD1234), so the sessionid was saved without .node1 in the Map, but the login page was loaded successfully.

When we click on Log-in I observed that .node1 was appended to the JSESSIONID9(ABCD1234.node1) and while validating we are trying to get the session date using without .node1 which is obviously return null and causing the exception.

I tried
1)  removing the  -Djboss.node.name from WildFly confuguration, in this case it is appending my pc name(ABCD1234.sreenath-WIN-7).

2) Removing <cache name="distributable" passivation-store-ref="infinispan" aliases="passivating clustered"/> from standalone .xml

Is there any way to avoid appending the extra characters to JSESSIONID on WildFly?

score 0 · Answer 1 · answered Sep 08 '15 at 05:23

You should never under any circumstances rely upon the value returned by javax.servlet.HttpSession.getId(). The servlet specification makes no promises regarding it's value, other than uniqueness. It's value can and occasionally will change during the life of the session. This is particularly true in a clustered environment.

If you need a key for session association then you should create your own (java.util.UUID.randomUUID()) and store it as a session attribute.

How to avoid appending -Djboss.node.name value to JSESSIONID

1 Answers1