TomEE中的Tomcat 7不维护会话； JSESSIONID cookie未发送

Question

We're using TomEE 1.7.0, which uses Tomcat 7.0.55. When we deploy our application, the session is not being maintained -- every time the application is accessed from a browser, the server creates a new session so any session variables (like authentication, etc) are lost. We tracked the HTTP requests, and the problem appears to be that the JSESSIONID cookie is being sent back to the browser, but is not being sent back to the server. In Internet Explorer, Fiddler shows that the "Cookies/Login" section of the request header is "DNT: 1" and in Chrome, it's just empty. If I run the exact same application, using the exact same browsers in an earlier version of Tomcat, it works perfectly -- we can access the session and we can see that the JSESSIONID cookies are correctly sent back and forth. That leads us to believe that it's something in the Tomcat server and not in the browser configurations.

We are stuck here; anybody have any ideas? Thanks in advance.

Answer 1

Answering my own question in case someone runs into the same issue!

The issue was that Tomcat 7 is now configured to send all cookies back as secured, so in our non-secured development environment the JSESSIONID cookie was not being stored. The solution is to go into the server.xml file, find the non-secure connector and remove the secure="true" attribute in development.