在 URL 中使用 JSESSIONID 时，会创建一个新会话

Question

I make the following request:

http://qwerty.localhost:82/Server/chat/connect;8O8488WlWWgNzAkGCFYAZyj3Bn91CR=05493D28DDD97308D66DAAC3DD66EAC2

or so:

http://qwerty.localhost:82/Server/chat/connect/;8O8488WlWWgNzAkGCFYAZyj3Bn91CR=05493D28DDD97308D66DAAC3DD66EAC2

In this case, the session id (8O8488WlWWgNzAkGCFYAZyj3Bn91CR) is passed both in cookies and in url (So it is necessary for the forest of safety, suddenly the cook will not be delivered). For some reason, a new session is being created. Why is this happening? what is wrong doing? can url not that ...

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
         version="3.1">

    <session-config>
        <cookie-config>
            <name>8O8488WlWWgNzAkGCFYAZyj3Bn91CR</name>
            <http-only>true</http-only>
        </cookie-config>
        <tracking-mode>URL</tracking-mode>
        <tracking-mode>COOKIE</tracking-mode>
    </session-config>

</web-app>

Answer 1

If there is always a new session is created for each request then, that means the client has cookies disabled and the URL-rewriting is not working properly. If you do encode your URLs, the Container will first attempt to use cookies for session management, and fall back to URL rewriting only if the cookie approach fails.

Try this way :
HttpSession session = request.getSession(false);//Passing “false” means the method returns a pre-existing session, or null if there was no session associated with this client.

and for URL Rewriting, use response.encodeURL()

Answer 2

Ok, as example and proof of concept i created worked sample

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
         version="3.1">

    <session-config>
        <cookie-config>
            <name>8O8488WlWWgNzAkGCFYAZyj3Bn91CR</name>
            <http-only>true</http-only>
        </cookie-config>
        <tracking-mode>URL</tracking-mode>
        <tracking-mode>COOKIE</tracking-mode>
    </session-config>
    <servlet>
        <servlet-name>Test</servlet-name>
        <servlet-class>org.company.TestServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>Test</servlet-name>
        <url-pattern>/*</url-pattern>
    </servlet-mapping>
</web-app>

servlet

package org.company;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.IOException;

public class TestServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        HttpSession session = req.getSession(true);
        resp.getWriter().printf(session.getId()+ " isNew:" + session.isNew());
    }
}

build script:

group 'org.company'
version '1.0-SNAPSHOT'

apply plugin: 'java'
apply plugin: 'war'

sourceCompatibility = 1.8

war{
    archiveName = 'ROOT.war'
}

repositories {
    mavenCentral()
}

dependencies {
    providedCompile group: 'javax.servlet', name: 'javax.servlet-api', version:'3.1.0'
}

After deploy war in tomcat:

request page without cookie

GET http://localhost:8080/
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1

response:

Content-Length: 48
Date: Mon, 12 Feb 2018 12:32:08 GMT
Set-Cookie: 8O8488WlWWgNzAkGCFYAZyj3Bn91CR=AD5F8B47BB0CEC1A08D8887FB82384BD.tc00;path=/;HttpOnly

page show AD5F8B47BB0CEC1A08D8887FB82384BD.tc00 isNew:true

if you open new browser ( or go to incognito mode ) and request page with cookie:

GET http://localhost:8080/;8O8488WlWWgNzAkGCFYAZyj3Bn91CR=AD5F8B47BB0CEC1A08D8887FB82384BD.tc00

you will get in return

AD5F8B47BB0CEC1A08D8887FB82384BD.tc00 isNew:false

headers

Content-Length: 49
Date: Mon, 12 Feb 2018 12:37:38 GMT

but if you change that value, for example

GET http://localhost:8080/;8O8488WlWWgNzAkGCFYAZyj3Bn91CR=AD5F8B47BB0CEC1A08D8887FB82384BD.tc01

than you will get new session 2061CBA151CE2148687B2BF48807253F.tc00 isNew:true and server will return set-cookie header

Content-Length: 48
Date: Mon, 12 Feb 2018 12:38:42 GMT
Set-Cookie: 8O8488WlWWgNzAkGCFYAZyj3Bn91CR=2061CBA151CE2148687B2BF48807253F.tc00;path=/;HttpOnly

Everything is work as expected, so problem related to different part of your programm.