The easiest thing to do is to change all your jsp's to have the following code. <[EMAIL PROTECTED] session='false'%>
Then unless you have code specifically asking for a session - no sessions should be created.
A simplier but uglier kludge is to create a Filter which overrides getSession and always returns null instead of allowing a session to be created.
-Tim
Jedidiah Northridge wrote:
Hello,
I don't need the functionality of session tracking, either through URL rewriting or via Cookie assignment. Is there anyway I can disable it completely?
More specifically, is there anyway I can stop my Tomcat from extracting the ";jsessionid=XXX" from an incoming URI? At present, when I analyze an incoming request, if the requested URI looks something like: "/index.html;jsessionid=XXX" by the time it reaches my servlet, it has been changed to "/index.html."
I'm running 5.0.28, and I'm using mod_jk2 as my Connector. When I debug the situation, I'm seeing the URI being changed as part of org.apache.coyote.tomcat5.CoyoteAdapter's parseSessionID. The method first parses out the session id, and then extracts it. For test purposes, I've used the HTTP Listener as my Connector, and I still see the same extraction behavior in CoyoteAdapter.
I'm asking about this because I'm using my Tomcat as a reverse proxy. I'm encountering difficulty when my Tomcat proxy sits in between a
client and a backend Tomcat that legitimately uses URL rewriting for
session tracking. When the backend tomcat rewrites a
";jsessionid=XXX" as part of a response, this gets back to the client,
but when the client requests it, my proxy tomcat (in the middle)
consumes the jsessionid that was meant for the backend. I presume
this unnecessarily uses memory for session tracking (in the middle),
but it definitely strips out the URL so that the jsessionid doesn't
make it to the backend.
I understand how to re-attach the ;jsessionid using the Session API before proxying the request to the backend. However, seeing as I don't need the session tracking (for the tomcat in the middle), I'd like to stop the process before it starts. Is this possible to achieve using any configuration options? Or programmatically? I see how to change CoyoteAdapter; but would prefer to avoid changing Tomcat code. If the only way to stop it all together is to alter tomcat code, is CoyoteAdapter the place to do it, or do you recommend another, "more correct," place to make a change?
Thank you very much,
-Jed Northridge
--------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
--------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
