Servlet充当代理：如何转发会话？

Question

I am not too sure about the feasibility of the requirement that I am trying to achieve, but here is how it goes:

• I have created a Servlet that acts as proxy. It receives a RESTful call and then invokes another RESTful service on a remote server (node).
• The forwarding is achieved via HTTPClient and not with a Request Dispatcher. I basically issue a new HTTP request to the remote server.
• When the first server (proxy server) receives the call, the request ( HttpServletRequest ) has a session associated with it. The isNew() property of the HTTPSession is false.
• When the call is forwarded and the remote server receives the call, the session gets to be a brand new one.

I am trying to basically find a way to forward the session to the remote server as well.

To be more precise:

Answer 1

It depends on how your remote WS maintains a session. If for example, it uses cookies (Tomcat does that amongst other techniques), then forwarding the incoming headers should help you achieve that (make sure that you mention that you accept cookies, but I thing HTTPClient does it by default). Now, if it is based on parameter in the URL, then you should try to reproduce that behaviour.

Answer 2

If the two nodes (proxy and service) are separate processes that are not part of an application cluster, then probably not.

The servlet container typically manages the HttpSession. If you are forwarding a request to another service, hosted by a different container, then you will have a different session object.

If the two nodes are part of a cluster, then typically the session can be shared between nodes in the cluster via a number of mechanisms (in memory replication, database synchronization, etc).

Another option, is to externalize your session data into something like Redis, Memcached, Coherence, etc. Some application servers have pluggable support for such a process. I believe in this scenario the application server nodes would not necessarily have to be party of a cluster to share the session data.

Answer 3

I lacked some of the fundamentals of session handling when I asked this question. After some research and discussion here is what I got:

• Basically, the sessions are handled by a JSESSIONID variable.
• JSESSIONID is created automatically (can be turned off) when the request hits the server.
• It gets sent back with in the response header.

• The reason why the remote server thinks it is a new session is because the request doesn't have this JSESSIONID set.

• The proxy does the following to ensure that the session is forwarded:

  1. When the incoming request comes in; create and store the JSESSIONID .
  2. Issue a new request to the remote server.
  3. Unpack the response header from the remote server and extract JSESSIONID .
  4. Maintain a mapping of client side JSESSIONID and remote server JSESSIONID .
  5. For any of the following request, use this mapping to send requests to the remote server.

Basically, the proxy does the mapping from the client side's JSESSIONID to the remote server's JSESSIONID . This way, the session gets forwarded to the remote server.