如何使用JSESSIONID设置特定的会话？

Question

I have a perfectly working web Java 1.5 web application that runs on Tomcat 5. The application is dependent on its session, so everything works well as long as the Session Cookie is passed around, or the JSESSIONID comes at the end of the context path like this ";jsessionid=..."

I now have to make my application work, in an environment that works like this:

• Every request to my app will be a POST to just one URL, with no parameters whatsover (so I won't be able to set the jsessionid in the context path).
• No redirects allowed, I have to return HTTP status 200 with my response.
• The body of the POST is an specific XML (I can add custom parameters there).

As my application is old and works well, I wanted to make this work without having to change everything. I was able to make the single URL thing work by adding as one of the parameters in the XML body, the actual URL that should be executed, and then forwarding the response to that URL, also appending the rest of the parameters there. Here is an example:

POST http://server.com/singleUrl.do

<xml>
  <parameters>url=realPage.do&amp;param1=value1&amp;param2=value2</parameters>
</xml>

I then forward this to:

http://server.com/realPage.do?param1=value1&param2=value2

And it works. I just added an abstraction layer to my application, and everything works fine. Except the session...

As no session cookies are ever sent, I lose my session between POSTs. I added the JSESSIONID as one of the custom parameters in the XML, like this:

<xml>
  <parameters>url=realPage.do&amp;param1=value1&amp;param2=value2&amp;jsessionid=ABC121312</parameters>
</xml>

And tried forwarding to:

http://server.com/realPage.do;jsessionid=ABC121312?param1=value1&param2=value2

But it doesn't work. The same thing, with a redirect, works. But of course, in my new requirement no redirects are allowed.

Finally, my question. How could I set the session that corresponds to that JSESSIONID? I'd like to do it in the same abstraction layer that processes the request before sending them to my "real" application.

Answer 1

I think I've come up with a solution for this... I've implemented a proxy, which parses the XML and then makes a new request, with the JSESSIONID in place. I then write the response of that request on the response of the real request.

I've made a prototype and it seems to be working. It's really ugly, but at least my application doesn't know any of this is actually happening.