JBoss 7.0.1 running without jsessionid in the URL is not working

Question

Because of some security reasons I deceided to disable session tracking by jsessionid in URL. Before I changed my web.xml to the one below, I had on the first time I visited the page a jsessionid in the url, after clicking the first link, it never appeared again.

My web.xml looks like

   <session-config>
      <session-timeout>10</session-timeout>
      <cookie-config>
         <secure>true</secure>
      </cookie-config>
      <tracking-mode>COOKIE</tracking-mode>
   </session-config>

Now I have the jsessionid in the URL, if I click another link on the page it never disappears. It changes on every click.

If I try to invoke a JSF action, I get an javax.faces.application.ViewExpiredException but the managed bean is @SessionScoped.

This is my dependency tree:

[INFO] Scanning for projects...
[INFO] Searching repository for plugin with prefix: 'dependency'.
[INFO] ------------------------------------------------------------------------
[INFO] Building Java EE 6 webapp project
[INFO]    task-segment: [dependency:tree]
[INFO] ------------------------------------------------------------------------
[INFO] [dependency:tree {execution: default-cli}]
[INFO] de.project:demoapp:war:1.0-SNAPSHOT
[INFO] +- javax.enterprise:cdi-api:jar:1.0-SP4:provided
[INFO] |  +- org.jboss.spec.javax.interceptor:jboss-interceptors-api_1.1_spec:jar:1.0.0.Final:provided (version managed from 1.0.0.Beta1)
[INFO] |  \- javax.inject:javax.inject:jar:1:provided
[INFO] +- org.jboss.spec.javax.annotation:jboss-annotations-api_1.1_spec:jar:1.0.0.Final:provided
[INFO] +- org.jboss.spec.javax.ws.rs:jboss-jaxrs-api_1.1_spec:jar:1.0.0.Final:provided
[INFO] +- org.hibernate.javax.persistence:hibernate-jpa-2.0-api:jar:1.0.1.Final:provided
[INFO] +- org.jboss.spec.javax.ejb:jboss-ejb-api_3.1_spec:jar:1.0.1.Final:provided
[INFO] +- org.hibernate:hibernate-validator:jar:4.2.0.Final:provided
[INFO] |  \- javax.validation:validation-api:jar:1.0.0.GA:provided
[INFO] +- org.hibernate:hibernate-jpamodelgen:jar:1.1.1.Final:provided
[INFO] +- junit:junit:jar:4.10:test
[INFO] |  \- org.hamcrest:hamcrest-core:jar:1.1:test
[INFO] +- org.jboss.arquillian.junit:arquillian-junit-container:jar:1.0.0.CR4:test
[INFO] |  +- org.jboss.arquillian.junit:arquillian-junit-core:jar:1.0.0.CR4:test
[INFO] |  +- org.jboss.arquillian.test:arquillian-test-api:jar:1.0.0.CR4:test
[INFO] |  |  \- org.jboss.arquillian.core:arquillian-core-api:jar:1.0.0.CR4:test
[INFO] |  +- org.jboss.arquillian.test:arquillian-test-spi:jar:1.0.0.CR4:test
[INFO] |  |  +- org.jboss.arquillian.core:arquillian-core-spi:jar:1.0.0.CR4:test
[INFO] |  |  \- org.jboss.shrinkwrap:shrinkwrap-api:jar:1.0.0-beta-5:test
[INFO] |  +- org.jboss.arquillian.container:arquillian-container-test-api:jar:1.0.0.CR4:test
[INFO] |  +- org.jboss.arquillian.container:arquillian-container-test-spi:jar:1.0.0.CR4:test
[INFO] |  +- org.jboss.arquillian.core:arquillian-core-impl-base:jar:1.0.0.CR4:test
[INFO] |  +- org.jboss.arquillian.test:arquillian-test-impl-base:jar:1.0.0.CR4:test
[INFO] |  +- org.jboss.arquillian.container:arquillian-container-impl-base:jar:1.0.0.CR4:test
[INFO] |  |  +- org.jboss.arquillian.config:arquillian-config-api:jar:1.0.0.CR4:test
[INFO] |  |  \- org.jboss.arquillian.config:arquillian-config-impl-base:jar:1.0.0.CR4:test
[INFO] |  |     \- org.jboss.shrinkwrap.descriptors:shrinkwrap-descriptors-spi:jar:1.1.0-alpha-2:test
[INFO] |  +- org.jboss.arquillian.container:arquillian-container-test-impl-base:jar:1.0.0.CR4:test
[INFO] |  \- org.jboss.shrinkwrap:shrinkwrap-impl-base:jar:1.0.0-beta-5:test
[INFO] |     \- org.jboss.shrinkwrap:shrinkwrap-spi:jar:1.0.0-beta-5:test
[INFO] +- org.jboss.arquillian.protocol:arquillian-protocol-servlet:jar:1.0.0.CR4:test
[INFO] |  \- org.jboss.arquillian.container:arquillian-container-spi:jar:1.0.0.CR4:test
[INFO] |     \- org.jboss.shrinkwrap.descriptors:shrinkwrap-descriptors-api:jar:1.1.0-alpha-2:test
[INFO] +- javax.mail:mail:jar:1.4.4:compile
[INFO] |  \- javax.activation:activation:jar:1.1:compile
[INFO] +- javax.servlet:javax.servlet-api:jar:3.0.1:provided
[INFO] +- org.owasp.esapi:esapi:jar:2.0.1:compile
[INFO] |  +- commons-configuration:commons-configuration:jar:1.5:compile
[INFO] |  |  +- commons-lang:commons-lang:jar:2.3:compile
[INFO] |  |  +- commons-logging:commons-logging:jar:1.1:compile
[INFO] |  |  |  +- logkit:logkit:jar:1.0.1:compile
[INFO] |  |  |  \- avalon-framework:avalon-framework:jar:4.1.3:compile
[INFO] |  |  \- commons-digester:commons-digester:jar:1.8:compile
[INFO] |  |     \- commons-beanutils:commons-beanutils:jar:1.7.0:compile
[INFO] |  +- commons-beanutils:commons-beanutils-core:jar:1.7.0:compile
[INFO] |  +- commons-fileupload:commons-fileupload:jar:1.2:compile
[INFO] |  +- commons-collections:commons-collections:jar:3.2:compile
[INFO] |  +- xom:xom:jar:1.1:compile
[INFO] |  |  +- xerces:xmlParserAPIs:jar:2.6.2:compile
[INFO] |  |  +- xerces:xercesImpl:jar:2.6.2:compile
[INFO] |  |  +- xalan:xalan:jar:2.7.0:compile
[INFO] |  |  |  \- xml-apis:xml-apis:jar:1.0.b2:compile
[INFO] |  |  \- jaxen:jaxen:jar:1.1-beta-8:compile
[INFO] |  |     +- dom4j:dom4j:jar:1.6.1:compile
[INFO] |  |     \- jdom:jdom:jar:1.0:compile
[INFO] |  +- org.beanshell:bsh-core:jar:2.0b4:compile
[INFO] |  \- org.owasp.antisamy:antisamy:jar:1.4.3:compile
[INFO] |     +- org.apache.xmlgraphics:batik-css:jar:1.7:compile
[INFO] |     |  +- org.apache.xmlgraphics:batik-ext:jar:1.7:compile
[INFO] |     |  +- org.apache.xmlgraphics:batik-util:jar:1.7:compile
[INFO] |     |  \- xml-apis:xml-apis-ext:jar:1.3.04:compile
[INFO] |     +- net.sourceforge.nekohtml:nekohtml:jar:1.9.12:compile
[INFO] |     \- commons-httpclient:commons-httpclient:jar:3.1:compile
[INFO] |        \- commons-codec:commons-codec:jar:1.2:compile
[INFO] +- com.sun.faces:jsf-api:jar:2.1.7:compile
[INFO] \- joda-time:joda-time:jar:1.6:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESSFUL
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 5 seconds
[INFO] Finished at: Mon Mar 19 12:55:23 CET 2012
[INFO] Final Memory: 31M/342M
[INFO] ----------------------------------------

EDIT: it looks like it's working without the

<cookie-config>
   <secure>true</secure>
</cookie-config>

the cookies is also in secure mode by default
is this normal? do i need this cookie config stuff not anymore? thanks!

@BalusC okay, something wired: everything is working if i delete: `true` even, if i'm checking the cookie, it's saved as secure code.... if i insert the secure stuff, i get a `Servlet.service() for servlet Faces Servlet threw exception: javax.faces.application.ViewExpiredException` - is this secure stuff not needed? — Joergi, Mar 23 '12 at 00:24
I have a similar issue caused by cookie-config. Only when it is set, an old turbine-based application goes into "infinite recursion". The strange thing is that there is no problem with true when accessing the server in HTTPS... — nettle, May 10 '12 at 14:33

score 1 · Accepted Answer · answered Apr 21 '13 at 12:00

are you using https ssl or port 80 http ? if using http then remove the secure cookie as secure means over ssl

Looks like web server realizes its not getting cookie and so making a new session every time. if you disable secure cookie (means make it false) then it should work.

it it does not make sure the browser is accepting cookies. https://www.youtube.com/watch?v=CVEo7wug2ks shows you how to see cookies (do not delete unless testing)

Alex · Answer 2 · 2012-10-08T21:32:20.627

Try using <http-only>true/false</http-only> in your cookie-config to find out if it is an issue with the cookie and the http-only add-on.

Actually http-only requires a browser supporting it and aims at protecting the cookie from someone retrieving the cookie on the client-side. So it should not be directly relevant. However I would not bet my house that this is correctly handled inside JBoss.

If for some reason the cookie is not generated with the 1st request the fallback of the server is usually encoding JSessionID in the URL.

score -1 · Answer 3 · answered Mar 17 '12 at 17:21

Have you tried setting the javax.faces.STATE_SAVING_METHOD to client in the web.xml?

<context-param>
    <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
    <param-value>client</param-value>
</context-param>

That should have the JSF state saved on the client side instead of the server.

JBoss 7.0.1 running without jsessionid in the URL is not working

3 Answers3

Linked