简体繁体 English

有关JSP会话的问题

[英]An issue dealing with JSP Session

原文 2009-08-19 23:36:00 1 3 java/ servlets

I'm having an inconvenient dealing with sessions.. 我在处理会议时感到不便。

I have this: 我有这个：

www.mydomain.com www.mydomain.com
sub1.mydomain.com sub1.mydomain.com
sub2.mydomain.com sub2.mydomain.com
sub3.mydomain.com sub3.mydomain.com

and when I log into "www", then I change to "sub2" (for example) I figure out it creates another session :S why is that?? 当我登录“ www”时，然后更改为“ sub2”（例如），我发现它创建了另一个会话：S为什么？

I need the same session for www, sub1, sub2, sub3, and so on.. ALL in "mydomain.com".. 我需要为www，sub1，sub2，sub3等使用同一会话。.全部在“ mydomain.com”中。

what can I do?? 我能做什么？？ is it like that and I have to make a trick?? 是那样吗，我得耍个招？ or is there a "legal" solution for what I want?? 还是我想要的“合法”解决方案？

3 个解决方案

The JSESSIONID cookie is issued by the container, and the cookie domain and path is always that of the web application's domain and context root. JSESSIONID cookie由容器发出，并且cookie域和路径始终是Web应用程序域和上下文根的cookie和域。

It appears as if you have multiple applications in which case, the JSESSIONID issued by one application will not be recognized by another, due to a change in either the domain or the context root, even if the applications are in the same container. 似乎您有多个应用程序，在这种情况下，即使应用程序位于同一容器中，由于域或上下文根的更改，一个应用程序发出的JSESSIONID也不会被另一应用程序识别。

There are multiple ways to deal with this: 有多种解决方法：

If you are not dealing with a high-value application, and if you can guarantee that no 'rogue' applications will be deployed on the server, you can configure the server to share sessions across applications. 如果您不处理高价值的应用程序，并且可以保证在服务器上不部署任何“恶意”应用程序，则可以将服务器配置为在应用程序之间共享会话。 Weblogic Server can be configured to do this. 可以将Weblogic Server配置为执行此操作。
Use a central authentication and session management provider - SSO. 使用中央身份验证和会话管理提供程序-SSO。
Use TLS/SSL - most servers do not issue a JSESSIONID cookie when communication is over SSL, and instead use SSL itself to store state. 使用TLS / SSL-当通过SSL进行通信时，大多数服务器不会发出JSESSIONID cookie，而是使用SSL本身来存储状态。 You will have mixed results here. 您在这里会有不同的结果。

Update : 更新：

Glassfish v3 allows you to set the domain for the session cookie. Glassfish v3允许您设置会话cookie的域。 This is done via the session-config element in sun-web.xml . 这是通过sun-web.xml中的session-config元素完成的。 I'm not sure if this is available in v2 or lower versions of Glassfish. 我不确定在v2或更低版本的Glassfish中是否可用。

Yes, it is like that because you will have separate session cookie for every different domain. 是的，那样是因为您将为每个不同的域使用单独的会话cookie。 Which web server do you use ? 您使用哪个Web服务器？ You may implement SSO related solution to share data across the domains. 您可以实施与SSO相关的解决方案以跨域共享数据。