Session Id Length in Tomcat

Question

We need to change the session ID length generated by tomcat. By default it is 32 bytes, unfortunately we need a session ID length of 20. Looking online I can see the StandardManager seems to manage this which extends PersistanceManager.

Does anyone know if the sessionIdLength can be modified in the tomcat config? If so what files?

An alternative would be to create a custom Manager which simply overrides/sets the sessionidLength. Is this possible? How do you tell tomcat to use the custom manager in the config?

Answer 1

Yes, you can modify the StandardManager via config file. The Manager element can be nested inside any Context.

So, modify whichever config file has your Context. It might be the server.xml located in the conf directory. Or a context.xml located in the META-INF directory of your war file.

To provide a default for the entire server, edit your $CATALINA_HOME/conf/context.xml. Uncomment the Manager line, and add the sessionIdLength attribute.

<Manager sessionIdLength="10" />

Answer 2

Add the sessionIdLength attribute to the element of your Tomcat's context.xml (or wherever you're manager is defined).

Incidentally, the docs say that the default is 16, not 32.