当支持http和https时，Spring启动tomcat httpsession不一样

Question

I have HttpSession problem when using Embedded tomcat with Spring boot. The scenario is as below: I start tomcat with spring boot, support both http & https. my application using spring security saml to support SAML logon. During debug I found that saml/login & saml/sso can't get same http session. But if tomcat only support http or https, the http session is same. Please help.

Thanks

Answer 1

A session created under https will not be accessible to an http request because the session cookie is marked as secure.

A session created under http should be accessible to an https request.