Menu
To put some context, i'm developing an API to track user actions on the site (anon users too). So far, we use jsessionId to identify each user and his actions.
That API, now runs on Tomcat and JBoss.
The really matter question is, since we analize all data one a day, is in any way the uniqueness of this jsessionId guaranteed all along the day? Or, not concurrently, can other user get the same jsessionId used previously by other one?
Thanks in advance.
518
JSESSIONID is a cookie generated by Servlet containers and used for session management in J2EE web applications for HTTP protocol. If a Web server is using a cookie for session management, it creates and sends JSESSIONID cookie to the client and then the client sends it back to the server in subsequent HTTP requests.
The jsessionid does not contain user credentials. It is a hash key into the server's map of HttpSession objects. Each authenticated user has an HttpSession, so each jsessionid locates the authenticated user information.
The JSESSIONID is generated from the servlet-container like jetty or tomcat or the builtin if you run a grails app standalone. The session-id is generated from the used http-server like apache, etc.
Sorry, it's not specified. It's only required to be unique for that jvm at that point in time. That is, session ids can be reused multiple times a day, as long as no one else has a session in place. I agree that most actual implementations might offer a stronger guarantee, but I don't think you can count on it.
Take a look at this mailing list - in it the people discuss session id reuse in both tomcat and resin.
So, basically the assumption the session ID is unique, is only true until the session gets destroyed.
76
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
