-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Anthony,
On 5/24/17 6:40 PM, Anthony, Clark R [US] (MS) wrote: > Hello, I'm currently using Tomcat 8.5.14. I'd like to be able to > limit the number of active sessions across the entire Tomcat > server. I saw the "maxActiveSessions" value in the Manager > configuration component, but that appears to be required to be > nested inside a Context object. So that would seem to me that it is > only available on a per-application basis. We have other people > deploying into our Tomcat instance and we can't depend on them to > set this limit properly for their app. > > Is there a way to limit these sessions globally, for the entire > Engine or Host server? If not, is this something that might be > considered for a new feature addition in the future? I'm using the > SingleSignOn valve if that helps (or hinders). There is no out-of-the-box way to limit the number of sessions which Tomcat will create across all web applications. The only risk in allowing an unbounded number of sessions is the use of heap space (or network bandwidth, if you are using clustering with distributed sessions). If you don't trust the applications you deploy, how can you be sure that even allowing them to create e.g. 100 sessions will limit them enough? I've seen applications with many megabytes of session data per session, and I have also seen applications which store only a few numeric ids in the session and nothing else. So having a "global session limit" is a bit meaningless. What are you really trying to accomplish - -chris -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlkokgsACgkQHPApP6U8 pFgCdg//U6xX2zE6AHozedG1t3fCLAJykGna7WCUzShcqJ7iUZk3gLR9biEPr5dz 9aDNTkBmBhUqSOi1FQ5LrJZCuCqdZfj1T+TMlwcjfxQUa0HwrWumpNW12U5JKyTo IRQLCOeA1Ljmm05MoMWD58r2C9jmXK94mZKXFd7MjAzSmEMf9sjpQ9x5rDLGoKIf ee0Fl7nmDPMlQzcIDu3NB25YFyTR2aPTUpLndjCsAzxyX04hEgMntHA84uJ7nwYf 2ve+x/Q1vDStQx/+3tWkJASEWN+Mi0BFNGDJx8WRpGR+rMDjKnJ6yMYDLayAVhKi fBRoaS7rK/26AIqhTqsIBQu2hJxNwDnoU98zTgMGhO5M1hWpBawgp31I6z+HnOZm 1aSfOmXJmlVDYSUqgm4ic/bDgK+72xgJAxRyYv+sBjK/LvsuPP43F92W+CuYksJo kK2wuwr5LcvgyiGykx+1xaYRaCXqT9SKsdyvzO70d9NUgFwCfGq7VOHPrcQHKM/w SgYrCVQt4NuGu9PgAv8B8bkBxq3Zc7a0vbLT1NyncOLu5h/wqrv79qsi2fP1kY4g eVGk9jOcRsVTkntl0ZaJlFnoElYJG7VFEbVj6B4NJWnseVvj02ff7GLL2QCt3xbu yN9DT38xEAwT3ywQicJNwh39BM9gfJY/70Zj6ITRQ4tgXpjgINs= =5D3D -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
