How to change the delimiter/separator in Tomcat for JSESSIONID and jvmRoute?

Question

Using Tomcat 9.0.13, openJDK 8 running on rhel 7.
Our application used to run on Websphere, where the session-route separator can be specified with the CloneSeparatorChange. The JSESSIONID is stored in a cookie set to Secure and HttpOnly.

Tomcat normally uses "." as its separator between the JSESSIONID and the jvmRoute (CloneID in the Websphere world), but our code is expecting the ":" set in Websphere.

My question: Is there a way to change the sessionid separator from "." to another character, say ":" ?

Answer 1

jvmRoute is handled by implementation of the SessionIdGenerator Component interface . The Standard implementation org.apache.catalina.util.StandardSessionIdGenerator doesn't offer a way to configure the separator used to add jvmRoute to JSESSIONID : https://github.com/apache/tomcat/blob/trunk/java/org/apache/catalina/util/StandardSessionIdGenerator.java#L52-L59 :

if (route != null && route.length() > 0) {
    buffer.append('.').append(route);
} else {
    String jvmRoute = getJvmRoute();
    if (jvmRoute != null && jvmRoute.length() > 0) {
        buffer.append('.').append(jvmRoute);
    }
}

'.' character is hard coded so you can't change it by configuration. Fortunately, you can configure the class used to generate the SessionId:

My suggestion is to extend the StandardSessionIdGenerator class, override the generateSessionId by calling the super method and replacing the character.

class CustomSessionIdGenerator extends StandardSessionIdGenerator{
    @Override
    public String generateSessionId(String route) {
        String sessionId = super(route);
        return sessionId.replace('.',':');
    }
}

You can then configure your CustomSessionIdGenerator class in a Manager component inside a Context component in tomcat's configuration files like context.xml .