Bug in session manager. If you work for Sun, please take a look.

Question

While evaluating what it would take to transition from Iplanet 6 to Sun Webserver 6.1, I found a problem with the Sun Webserver's s1ws60 session managers. If the page is not explicitly flushed before ending, the session cookie JSESSIONID is never sent. So as long as the user continues to visit small pages, they keep getting new sessions (because they are never sent a session id, so the session manager creates a new one every time they visit). The session cookie is sent if larger pages are visited (the buffer is automatically flushes). The session cookie is also sent if out.flushBuffer() is explicitly called within the JSP. This problem was not present in IWS6.0.
The problem has been tracked down to a combination of the code in com.iplanet.server.http.session.IWSSessionManager (found in the "plugins" directory) and the JSP's Java code generated by a component of the webserver (Catalina?). Under Iplanet, the code generated in the finally{} section of the JSP first flushed the buffer, then called releasePageContext. Under Sun Webserver, the code generated just calls releasePageContext without explicitly flushing the buffer before the call. When flushing the buffer for a non-committed response, the headers are first generated and sent, along with any cookies, including the session cookie. The server only sends the session cookie if, among other things, the session satisfies "_session.isNew()". The order of events in releasePageContext ensures that this is never true when used in combination with IWSSessionManager. I don't have the source code to verify this, but from experimentation I think this is the reason: Before the buffer is flushed, the session is saved by IWSSessionManager.update(session), which at line 498 calls "sn.unsetNew()". So the session is never isNew() when it gets around to sending the session cookie. This can be resolved by either adding an explicit buffer flush to the finally{} section of the JSP, or removing the unsetNew() call from IWSSessionManager. Since I don't know where the code that generates the JSP is (or if I can even change it), I ended up removing the sn.unsetNew() call from the update() function.
Here's the code generated in the finally{} section using IWS6 and Sun Webserver:
Iplanet 6
        } finally {
            if (out != null && (out instanceof org.apache.jasper.runtime.JspWriterImpl)) {
                ((org.apache.jasper.runtime.JspWriterImpl) out).flushBuffer();
            if (_jspxFactory != null) _jspxFactory.releasePageContext(pageContext);
        }Sun Webserver
        } finally {
            _jspx_releaseTags(_jspx_curTag, null);
            if (_jspxFactory != null) _jspxFactory.releasePageContext(pageContext);
        }

Answer 1

I posted a bug report on this.