Spring security context path resolver

Question

I want to define the path of the session cookie, which is set from spring security, in order to allow multiple logins from the web-app. E.g:

http://localhost:8080/myApp/context1/login
http://localhost:8080/myApp/context2/login
http://localhost:8080/myApp/context3/login
...

Basically this is possible by overwriting LoginUrlAuthenticationEntryPoint, SimpleUrlAuthenticationFailureHandler, SimpleUrlAuthenticationSuccessHandler, SimpleUrlLogoutSuccessHandler. However I cannot find a handler, which is responsible for setting the cookie context-path, which I need to overwrite from:

/myApp

to the apropriate equivalent:

/myApp/context1

This is needed, in order to allow parallel logins to these Apps.

Q: How to change the cookie's path for session cookie (HttpSession) dynamically for tomcat?

Answer 1

Your application container is responsible for sending session cookies to clients. Inside Spring Security code you will only see lines like this:

HttpSession session = request.getSession();

There is no session-cookie-creation logic inside Spring Security source code. That's why there are no interfaces to implement or configuration attributes to provide custom paths.

To specify path that will be assigned to any session cookies created by your web application you can put:

<web-app>
    <session-config>
        <cookie-config>
            <path></path>
        </cookie-config>
    </session-config>
</web-app>

in your web.xml descriptor.

However you want to have many sessions in one web application. Why don't you deploy new application for each user context? It's the most logical approach.

Edit: I'm afraid you want to achieve something that can be easily done without tinkering with session. Your problem looks more like authorization and not authentication. Maybe you need to use roles for each context? Or access control lists?