On Fri, 6 Apr 2001, Andy Mauro wrote:
> Hey all.
>
> This is sortof a JSP/Servlet related question, but it falls within the scope
> of this forum:
>
> Can someone give me a compelling reason why sessions cannot be shared across
> contexts? I realize this is part of the Servlet 2.2 spec, and not strictly
> speaking a tomcat issue, but perhaps there is a way to work around this
> limitation in tomcat?
>
> I can't think of a good reason for disallowing session sharing between
> contexts. Ideas?
>
> Thanks in advance,
> -Andy
>
>
The technical reason is straightforward -- different web apps are loaded
by different class loaders. Thus, the classes used to define the beans
stored in session scope of web app A would not be visible to the class
loader used for web app B.
There's also pretty nasty security implications if cross-webapp session
access were to be allowed. Consider an ISP environment where several
customers's web apps are running in the same servlet container. Do you
*really* trust all of the other web apps not to muck around with your
sessions?
Craig McClanahan
