是否在同一会话中运行多个浏览器实例

Question

I need to consolidate separate browser's sessions in one. Please read me carefully, I know that multiple tabs, or windows coming from the same browser instance will do it automatically. However I have separate instances of the same browser which share same president sessions pool. It means if I enforce session cookie persistence option, the task gets resolved automatically. However not many App Servers support the option. Some servers like WebSphere provide an option as remember me, however it sets a persistent cookie with limited trust, and as result a user can be prompted for login information. So I need some push on thoughts. I can see currently one approach

1. When user signed from one instance, some persistent cookie gets established keeping some token.
2. The token is a key in some singleton map holding session objects
3. Any servlet code requesting session and not getting it, can check for the cookie and use token to get session from session map
4. Session listener removes session from session map at extirpation

I need you opinion on

1. possible security problem
2. Possible resource leakage
3. extension of the solution in cluster Thanks for any thoughts, but please do not try to convince me I do not have use case for that. If you want to know use case, e-mil me privately.

Answer 1

1. If the cookie data is encrypted for the user session using a key on the server and some non repeatable session identifier then you only have to worry about a "man in the middle" which can be mitigated using ssl.

2. I do not see this as an issue as you said you have a sliding expiration for your server sessions and your server should reclaim the resources when that expiration is reached.

3. Unless you are using some backing store to support sticky session persistence your user's session will be lost during a failover.

Also, keep in mind that your authentication cookie is only good for the domain at which it was issued.