JSESSION Cookie
Hi,
i' have a problem:
The JSESSIONID cookie generated by the site is not marked with the secure
flag. Depending on the browser in use by the client, this can allow
authenticated session cookies to be sent in clear-text. See screenshot
below.
How mark JSESSIONID secure ¿? by jsp pages ?
thanks.
Thanks for the useful link.
The doc really make the JSESSIONID a secure cookie.
But in this scenario, the session does not work in HTTP mode.
So I want to know:
1) Is there any way to make HTTP session still works whell JSESSIONID in HTTPS remains secure;
2) Can I only configure the weblogic just for some applications instead of whole Weblogic environment?
Because in our production environment, all businesses portal share the same weblogic instance.
If I use the CookieSecure attribute then it impacts all the other businesses and this is absolutely forbidden.
In addition, I found BEA give another solution:
<WebServer Name="myserver" AuthCookieEnabled="true"/>
http://e-docs.bea.com/wls/docs61/webapp/security.html#118730
But I have tested in Weblogic6.1 SP5 and found it does not work.
Does anyone have any idea about the AuthCookieEnabled attribute?
Thanks in advance!
Any clue will be highly appreciated!
Regards,
David
Similar Messages
-
Need help to get JSESSION cookie after making a SOAP request.
Hello All,
I need to know that how can I check JSESSION cookie, and get its value after sending a SOAP request. I need this JSESSION value to present in each HTTP stream until it expired. One more question, can I log HTTP request and response by configuring the client-config.wsdd or not. If yes, could any one let me know how to do it please. Thank you in advance.Turn the machine on it's side and try shaking them out. You can also see if You Tube has any videos on how to do this, they certainly do for folks that have SD cards in theirs. Removing coins should be similar.
-
JSession cookie dropping cause DuplicateSessionDetected exception when use https rather than http
I developing Grails+BlazeDS server and Flex AIR client and stucked with this error: Detected duplicate HTTP-based FlexSessions, generally due to the remote host disabling session cookies. Session cookies must be enabled to manage the client connection correctly
Google searches didn't successfully, as I see some difference in situations. The issue I got only when Flex client interact with server via https.
Flex client:
<s:ChannelSet id="userChannel">
<s:SecureAMFChannel uri="https://localhost:8443/Con/messagebroker/amfpolling" />
</s:ChannelSet>
button click in UI triggered login method:
loginResult.token = channelSet.login(usernameInput.text, passwordInput.text);
And finished with DuplicateSessionDetected exception.
After investigating network monitor logs, I found that a jsession cookie received from server not set in next requests to a server:
Response from server (operation: client_ping):
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=F58F1ADA97E70915EF9E6E4EE1AEBE00; Path=/; Secure
Content-Type: application/x-amf
Content-Length: 173
Date: Sun, 23 Feb 2014 10:17:00 GMT
Flex Message (flex.messaging.messages.AcknowledgeMessageExt) clientId = EA18E8B9-951F-6F87-7B47-48B8B202EE75 correlationId = 7D2782C1-C8A5-41A3-2055-5E3F771424C8 destination = null messageId = EA18E8F6-9E0E-1FE4-0D26-6F0E602F5C5E timestamp = 1393150620542 timeToLive = 0 body = null hdr(DSMessagingVersion) = 1.0 hdr(DSId) = EA18E8B9-950B-4B42-EF70-369D656BA3F2
And next request to server (login operation) without jsession cookie:
POST /Conn/messagebroker/amfsecure HTTP/1.1
Referer: app:/BlazeDSClient.swf
Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9, text/plain;q=0.8, text/css, image/png, image/jpeg, image/gif;q=0.8, application/x-shockwave-flash, video/mp4;q=0.9, flv-application/octet-stream;q=0.8, video/x-flv;q=0.7, audio/mp4, application/futuresplash, */*;q=0.5
x-flash-version: 12,0,0,68
Content-Type: application/x-amf
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows; U; en) AppleWebKit/533.19.4 (KHTML, like Gecko) AdobeAIR/4.0
Host: localhost
Content-Length: 299
Flex Message (flex.messaging.messages.CommandMessage) operation = login clientId = null destination = auth messageId = 7B47BBF2-08C0-0E41-5D88-5E3F76FA4882 timestamp = 0 timeToLive = 0 ***not printing credentials***
and server answering with new session cookie:
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=03BD8347F9E9511C299B717DD55625C9; Path=/; Secure
Content-Type: application/x-amf
Content-Length: 535
Date: Sun, 23 Feb 2014 10:17:01 GMT
Flex Message (flex.messaging.messages.ErrorMessage) clientId = null correlationId = 7B47BBF2-08C0-0E41-5D88-5E3F76FA4882 destination = auth messageId = EA18F4A7-C80D-103B-F8D0-58B6F148F142 timestamp = 1393150621768 timeToLive = 0 body = null code = Server.Processing.DuplicateSessionDetected message = Detected duplicate HTTP-based FlexSessions, generally due to the remote host disabling session cookies. Session cookies must be enabled to manage the client connection correctly. details = null rootCause = null body = null extendedData = null
And again - when used non-secure protocol everything ok - session cookie sevt to server in login operation as expected.
I have a little experience in Flex development and didn't find any method to set session cookie when triggered channel login request. Could you help to resolve this issue, please?
Thanks.Finnaly resolved it. I meet similar questions in the web, so I hope this solution will be helpfull for somebody.
The cause of DuplicateSessionDetected exception has been a Network Monitor tool of Flash Builder. After switching it off no any exception has been occurred. I think there issues when Monitor acting as proxy when used with secure protocol. -
Why, if I delete the Jsession cookies and I reload the index.faces page, and post the login form, this error happend ?
ViewExpiredException: viewId:/login.faces - View /login.faces could not be restoredNew JSession cookie isn't created... Strange ?I can't find a real solution for that problem !
In IE, the website seem to work, but without cookies... why ?
In Firefox, after deleting the JSESSION cookie, if I reload (ctrl+F5), the cookies isn't created anymore... if I try many time, maybe 2-3 min later, the cookie is created ...
Without cookie, I have the error about the view.
Sometime, without any change, in Firefox, it work but using URL variable for session... and after few login-logout-login, it use JSESSIONID cookie !
Any idea ? This kind of random problem is hard to solve.
web.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<context-param>
<param-name>javax.faces.DEFAULT_SUFFIX</param-name>
<param-value>.xhtml</param-value>
</context-param>
<context-param>
<param-name>URL</param-name>
<param-value>ldap://localhost:10389</param-value>
</context-param>
<context-param>
<param-name>managerDN</param-name>
<param-value>uid=admin,ou=system</param-value>
</context-param>
<context-param>
<param-name>managerPassword</param-name>
<param-value>****</param-value>
</context-param>
<context-param>
<param-name>facelets.DEVELOPMENT</param-name>
<param-value>true</param-value>
</context-param>
<context-param>
<description>valide le fichier faces-config</description>
<param-name>com.sun.faces.validateXml</param-name>
<param-value>true</param-value>
</context-param>
<context-param>
<description>vérifie si tous les objets configurés sont créé correctement</description>
<param-name>com.sun.faces.verifyObjects</param-name>
<param-value>true</param-value>
</context-param>
<context-param>
<param-name>javax.faces.STATE_SAVING_METHOD</param-name>
<param-value>server</param-value>
</context-param>
<context-param>
<param-name>javax.faces.CONFIG_FILES</param-name>
<param-value>/WEB-INF/faces-config.xml</param-value>
</context-param>
<filter>
<filter-name>MyFacesExtensionsFilter</filter-name>
<filter-class>org.apache.myfaces.webapp.filter.ExtensionsFilter</filter-class>
<init-param>
<param-name>uploadMaxFileSize</param-name>
<param-value>20m</param-value>
</init-param>
</filter>
<!-- extension mapping for adding <script/>, <link/>, and other resource tags to JSF-pages -->
<filter-mapping>
<filter-name>MyFacesExtensionsFilter</filter-name>
<!-- servlet-name must match the name of your javax.faces.webapp.FacesServlet entry -->
<servlet-name>Faces Servlet</servlet-name>
</filter-mapping>
<!-- extension mapping for serving page-independent resources (javascript, stylesheets, images, etc.) -->
<filter-mapping>
<filter-name>MyFacesExtensionsFilter</filter-name>
<url-pattern>/faces/myFacesExtensionResource/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>com.sun.faces.config.ConfigureListener</listener-class>
</listener>
<listener>
<listener-class>com.sun.faces.application.WebappLifecycleListener</listener-class>
</listener>
<servlet>
<servlet-name>Faces Servlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>0</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>*.faces</url-pattern>
</servlet-mapping>
<session-config>
<session-timeout>2</session-timeout>
</session-config>
<welcome-file-list>
<welcome-file>index.html</welcome-file>
</welcome-file-list>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
</web-app>
index.html
<html>
<head>
<meta http-equiv="Pragma" content="no-cache" />
<meta http-equiv="expires" content="0" />
<meta http-equiv="Cache-Control" content="no-cache" />
<meta http-equiv="Cache-Control" content="must-revalidate" />
<meta http-equiv="Refresh" content="0; URL=login.faces" />
<title>Start Web Application</title>
</head>
<body>
<p>
Please wait for the web application to start.
</p>
</body>
</html>Edited by: laurentw on Feb 10, 2009 4:12 PM
Edited by: laurentw on Feb 10, 2009 4:13 PM -
Arrowpoint cookies and state changes
We have an 11050 6.10 build 4 (replacing it soon with a 11501) that is setting a cookie so we can stick a client to a server. The application is also setting a JSESSION cookie. The service is doing a HEAD to a specific page to verify the service is up. The service can change state often (say 1000 times in 2 hours) but the service is not always marked as down. It may only be marked as down 5 to 10 times in those 2 hours. The users are experiencing slow response and are getting kicked out of the application and going back to a login screen. My questions are:
1. State Change Counters. If I go from alive to dying to alive is that 1 or 2 state changes?
2. If a service is dying and a client connects to the service with the cookie already set will the CSS send them to the dying server or will it send them to the alive server? If it sends them to the alive server does it reset the cookie?
3. If the service is down does the CSS send a RST to the client or does it just over write the cookie and send it to the alive server?
4. Service timeouts. Is it true that the timeout for a service is the frequency -1? So if I have a frequency of 5 seconds if the CSS doesn't get a response within 4 seconds the service would go to the dying state?
ThanksThanks for the response. According to the Cisco documentation below when a service is down the client will be directed to the alive server. If clients aren't automatically sent to the alive server how would they ever get off the down service?
The service isn't strange it's the app that's strange ;-) Basically they're getting slow response and the clients are getting kicked out of the app. As usual they want to blame every thing else but the app.
The increase that I thought I was seeing in the state counters might not be accurate. When I did the show service it said the counters had been cleared this morning and they were already up to 1300. However, no one logged into the CSS except our Ciscoworks server. I'm not sure why it said they were cleared this morning unless CW2K is doing it. I cleared the counters and they're back to zero so I'll monitor it.
---Cisco Doc-------
When a client comes in with a valid cookie request but the sticky server is not available, the CSS uses the sticky-serverdown-failover configuration to handle the request.
By default, the sticky-serverdown-failover is configured as balance. The sticky-serverdown-failover balance method will treat the client's request as an initial request without the ArrowPoint cookie. It uses the load-balancing algorithm to choose a server, and then redirects the request with a generated ArrowPoint cookie.
The other option is a failover type of redirect. In this case, the CSS redirects the request to the specified URL.
The command sticky-no-cookie-found-action should not be configured in an ArrowPoint cookie content rule. Not only will this command not work, it produces many irregularities in the CSS.
http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_tech_note09186a00801c8c2f.shtml -
Implementing logout. Single Sing Off
Hi I have developed an application using SSO.
These are the steps I followed:
1. In the Orion-application.xml:
<jazn provider="LDAP" location="ldap://hn-apli-dev.bcie.org:389" default-realm="jazn.com">
<jazn-web-app auth-method="SSO"/>
</jazn>
2. In the web.xml
â¦â¦.
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>jazn.com</realm-name>
</login-config>
â¦â¦.
<security-constraint>
<web-resource-collection>
<web-resource-name>appName</web-resource-name>
<url-pattern>/</url-pattern>
</web-resource-collection>
<auth-constraint>
â¦â¦.
The login works OK but I canât implement the Single Sing Off .
I tried using this code
// Set the return URL
response.setHeader("Osso-Return-Url", "http://my.oracle.com" );
// Send Dynamic Directive for logout
response.sendError(470, "Oracle SSO");
But it works just for applications defined as Partner Applications.
What else should I do?Seems like you are using mod_osso for enabling Single Sign-On to your applications. In this case, you do not have to register individual applications to the Single Sign-On server as a partner applications. Mod_osso registration should be sufficient and login/logout will work fine.
However, if you are creating application session and using that to show application content then logout will not work correctly. This is because single sign-off will not remove those JSESSION cookies (since they are application specific). To ensure that these application sessions can not be reused when user logs out, implement the application security logic as documented developer's guide.
Oracle® Identity Management Application Developer's Guide
10g Release 2 (10.1.2) Part No. B14087-01
Section 7.4 Security Issues: Single Sign-Off and
Application Logout -
Integrating Windows Live web service using Jdeveloper
Hi,
We are integrating windows live web service in our oracle portal application. We are trying to create a web service proxy using the URL https://domains.live.com/service/managedomain2.asmx?wsdl. But, we just get an error saying "No WSDL document could be found". Please let me know how to access this web service.
Please note that we are able to access this web service through the browser.
Regards,
MJWhen building the service, there is an option to deploy a stateful service: check the stateful checkbox, in the step 2 of the wizard - Methods definition.
On the client side, you will have to enable HTTP based cookie, so that the client remember the JSESSION cookie.
Hope this helps,
Eric -
Hi,
My application is clustered on multiple machines. The application receives
request mainly through the http protocol, and the application keeps session information
of the user. I am using HttpClusterServlet to proxy request to the cluster.
How can I get the servlet to proxy requests to the right machine that has the
session information. (Currently, it's just using the round robin algorithm)
Thanks
It should do this automatically - it looks at the WebLogicSession (or jsession)
cookie to determine where to send the request.
Mike
"Mark Liu" <[email protected]> wrote:
>
>Hi,
>
> My application is clustered on multiple machines. The application
>receives
>request mainly through the http protocol, and the application keeps session
>information
>of the user. I am using HttpClusterServlet to proxy request to the cluster.
>
>How can I get the servlet to proxy requests to the right machine that
>has the
>session information. (Currently, it's just using the round robin algorithm)
>
>Thanks
>
-
SuperWebservice supporting stateful Web Service
Acelet (http://www.acelet.com) has released a new version of Super with SuperWebservice supporting stateful Web service and SuperLogging combining traditional logging and LimpidLog. LimpidLog is a revolutionary logging: there is no need to hard-code logging statement. LimpidLog is an open source program.
When building the service, there is an option to deploy a stateful service: check the stateful checkbox, in the step 2 of the wizard - Methods definition.
On the client side, you will have to enable HTTP based cookie, so that the client remember the JSESSION cookie.
Hope this helps,
Eric -
JAAS LoginModule - how do I get the "JSessionId"
Hi,
is there any possibility to get the JSessionId from a custom JAAS LoginModule for the WebAS 6.40 Server.
My first attempt was to read the JSESSIONID-Cookie from the Http-Request via the HttpGetterCallback-Class.
((HttpGetterCallback) callbacks[1]).setType(HttpCallback.COOKIE);
((HttpGetterCallback) callbacks[1]).setName("JSESSIONID");
It worked well, till I noticed that sometimes the JSessionId-Cookie doesn't exist.
The reason is, that the JSession-Cookie was set after the http-request has passed my login-modul.
So, if I got a cookie-value, it sometimes was the JSessionID from an earlier session.
So, my question:
Is there any other posibility to get the JSessionId?
If there is a way to get the ServletRequest-instance, I could reach the SessionId via "HttpServletRequest.getSession()".
Any idea? Any hints?
Regards
Steffen SpahrThis is only available for NetWeaver Portal, not NetWeaver Application Server(WebAS). host and port can be obtained using the following code:
Callback[] callbacks = new Callback[3];
callbacks[0] = new NameCallback("UserId: ");
callbacks[1] = new PasswordCallback("Password: ", false);
// get host name and port
HttpGetterCallback getterCallback = new HttpGetterCallback();
getterCallback.setType(HttpCallback.HEADER);
getterCallback.setName("Host");
callbacks[2] = getterCallback;
try {
callbackHandler.handle(callbacks);
} catch (Exception ex) {
throw new LoginException(ex + "");
Object retValue = ((HttpGetterCallback)callbacks[2]).getValue(); //get host
host and port will be returned in the following format SERVER.COMPANY.COM:50000
Currently WebAS is not able to return the resource as per SAP development. -
hi,all,
I am working on a web app which stores customer's userid into session. on each of my jsp page userid is extracted from session. The problem is, if the customer's browser makes another site(not ours) as their home page, after the web page of this default web site loaded, if the customers uses same browser window to access our site, two sessionids are forwarded back.
For example, if the home page of the browser is www.bell.ca, after the first page of bell's site loaded, a customer starts to access our site in same browser window. But on our server, we can see there are two cookies with same name "JSESSIONID" but different value. One is from our site, another one is from bell. But our server seems could not tell which one is ours. The interesting thing is, if the browser does not set www.bell.ca as home page, or set to other site, like, www.yahoo.ca as home page, this problem did not exist.
I checked bell's site, found these, but I am not sure if this is the key.
<meta http-equiv="pragma" content="no-cache">
<meta http-equiv="Expires" content="Tue, 20 Aug 1996 14:25:27 GMT">
So, my question is, is there any way to clean other JSESSIONIDs detected from browser; or if it is possible to set up something like "filter" on server side, to block JSESSIONID not originated from some particular URLs.
Btw, we tried to set cookies on both server side and browser, it did not work.
The server is on solaris, with apache and tomcat 4.1. Both IE6 and Netscape 4.7 has same problem.
Thanks for any help.As you describe this problem in two diffent brands of browsers I started to wonder -- a browser passing a cookie of another site would be a serious security / privacy leak. But then: obviously NN4.7 is quite old and IE6, well... Did you test with any other browsers as well, and with what results? I'd especially recommend Mozilla Firebird with the Live HTTP Headers extension installed, to easily see the real headers (rather than some http-equiv's): http://livehttpheaders.mozdev.org/
Anyway: in IE6 / SP1 / WinXP I've set http://www.bell.ca to be my homepage, then closed the browser and opened it. Once the page loaded, typing javascript:alert(document.cookie) in the address bar, gave me something like
SITESERVER=ID=5b9cd01f1ff32686bd0e90372e3a51a2;
ASPSESSIONIDCATSRDQR=HFIMGFCCHFBFKAHCHMAKAMIF;
s_cc=true;
JSESSIONID=QCUi29yqFaft6nT28j11Qpexb9aMrAAp3prOLpIhdjzoO....
Note that on WinNT/2000/XP you can hit Ctrl-C to copy the dialog text to your clipboard. Then, in the same window browsing to http://forum.java.sun.com, gave me
JSESSIONID=forum.java.sun.com-119030%253A40252....;
jive.user.lastvisited=1076175702595
What if you repeat this? Does your server really see the www.bell.ca session cookie? Compare the value from your browser with what you see on the server! And please tell us what you've found, as this is interesting -- and scary...
You're not by any change creating a site for a subdomain of bell.ca, are you? Well, even then the cookie should have been overridden with its new value, not stored as an extra cookie. Using Firebird, Live HTTP Headers shows that the JSESSION cookie originates from http://www.bell.ca/shop/application/commercewf and has the domain set to .bell.ca, which is perfectly valid (though funny to see Microsoft IIS here):
HTTP/1.x 200 OK
Server: Microsoft-IIS/4.0
Date: Sat, 07 Feb 2004 18:30:38 GMT
Connection: close
Set-Cookie: JSESSIONID=QCUuzoGhvWfNuybw...; domain=.bell.ca; path=/
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Type: text/html
Nothing odd here, if you'd ask me...
Arjan. -
Hi,
There are situations where we need requests go through a particular instance of the cluster.
Knowing that http server plugin mantains the stickness over a weblogic cluster using the jvmid part of JSESSION cookie,
is there a way to force Weblogic JVMID at startup ?
Thanks,
Christian.Dominique4631 wrote:
That's the problem, when I scroll down the mms settings do not appear only the apn settings, the mmsc settings do not appear
I have the exact same issue as well.
Rogers Z10 - OS 10.2.1.1925 (I have tried multiple OS's ever since OS 10.1 it has had this problem)
My Text Advanced settings are:
Advanced
SMS
Allow Special Characters On
Service Center Address +17057969300
Routing Preference Circuit Switch Prefered
Send Text-Only Messages as Automatic
Retires 3
APN Settings
APN ltemobile.apn
Username (blank)
Password (blank)
Are these the same settings that everyone else has????????
See picture below
Thanks,
Brian -
Cookie set on the request from flex disappers
All,
I need to set cookie for calls from flex. So on the server side I set the cookie and send the response back to flex. I used tools like tamperdata and debugbar to monitor the request calls and I found that the cookie i set is available + a
JSessionID cookie is also available in the response headers "
Set-Cookie".Since cookie is set on the response headers, it is expected to be available in all the next successive calls.
But on my next successive call I see only the the Jsession id for all the calls. And in some call i see the cookie I set.
I use caringorm framework. So far I have analysed and found that if the call goes from same delegate I see my cookie, but if its from different delegate then i don't see the cookie in the request. I tried using same delegate for all my commands by creating objects of the same delegate but still it didn't work.
I feel creazy when i thing why only JseesionId is available in the cookie and not the one which i set in the calls irrespective of the delegate. I am not sure where i am going wrong. Even when i try to do document.cookie in the external interface call or in the URL using Javascript alert I only see a empty string not ven the Jsession id in the document.cookie. some thing is really creazy.
Sicne result event does not have the option of cookie, is flex eating the cookie set on the response. Then why on Jsessionid is available? I have also seen that in HTTPServiceMessage has an option of recordHeaders. Is my isseu is related to this. If so please let me know an example to use this. I am going insane with this issue. Please help!!It's probably not the same delegate you need to hit, but exactly the same HTTPService.
This is a bit I've gleaned from encountering similar issues, so it might not be exactly right!
The Flash Player attaches the cookie info into the Channel that is used to make the call. If you want the same cookie, you need to use the same Channel.
The jsessionid you are seeing is the way the same session is indicated to back end resources, so if two Flash apps hit the same service it knows they are different.
The way I'm currently playing with, is to keep the ChannelSet around and inject it into Services as I need them, that's covering most of my problems! -
Application lost existing session due to new jsession id.
Hi Team,
We have three linux box in production and each box contains apache and weblogic managed server.
IP and apache port is configured in our ACE load balancer.
-----A1---M1
|
ACE- --|-----A2---M2
|
-----A3---M3
A1,A2,A3-Apache servers, M1,M2,M3 - Managed servers.
apache version is 2.2.22 and weblogic version is 11G. mod_wl.so is used to redirect from apache to weblogic.
Each apache will redirect to corresponding managed server.
Our application(java based) is deployed in weblogic cluster.
when the user test the application via load balancer, it cater the request to apache and apache redirect to managed server.
The problem is new jsession id is creating in between some request and application lost our existing session
we have captured http headers and have seen new cookie created in response header.
<header>Set-Cookie: JSESSIONID=pjrLRs2QCPpnP89p553Y4y0MfGp6rTy3kv4sP5TQG5MV3mV4xmfm!-1368207527; domain=.abc.com; path=/; secure=true</header>
The above problem doesnt happen when we use single apache server.
-----A1---M1
|
ACE -| A2---M2
|
A3---M3
Can you please help here to sort out this issue.
Regards,
Ganesan
Edited by: 992087 on Mar 6, 2013 2:39 AMjpark5009,
Thank you so much for the full details on the issues that you are having. I do apologize that no one has reached out to you after the call was lost. We want to make sure we get a chance to review the account. The only way we can do that is to be in a direct message. I did send you a direct message. Please respond back to that message.
KevinR_VZW
Follow us on Twitter @VZWSupport -
CSS Load Balancing with Cookies
We are trying to load balance 2 backend servers hosted on Websphere with advance balance cookies method.
Restrictions
ServerA is unable to accept cookies generated from ServerB.
ServerA and ServerB are generating random cookies
Unable to modify cookie string with a constant.
How can we load balance based on cookies considering the above restrictions?
We have attempted to do hash based load balancing with cookies but the problem we run into is the servers do not accept cookies generated from another server.
The configuration we tried is written below:
service ServerA
ip address 192.168.10.2
keepalive type tcp
keepalive port 80
active
service ServerB
ip address 192.168.20.2
keepalive type tcp
keepalive port 80
active
content ABC
url "/*"
add service ServerA
string prefix "JSESSIONID="
advanced-balance cookies
port 80
add service ServerB
string skip-length 5
string process-length 16
string operation hash-xor
protocol tcp
vip address 172.16.32.1
active
Can we change the string prefix to JSESSION instead of JSESSIONID= ?
The only place the app guys can add a constant string to match on is before the = sign.
Is it possible for CSS to match on a constant string before = sign e.g below:
service ServerA
ip address 192.168.10.2
keepalive type tcp
keepalive port 80
string id567=
active
service ServerB
ip address 192.168.20.2
keepalive type tcp
keepalive port 80
string id123=
active
content ABC
url "/*"
add service ServerA
string prefix "JSESSION"
advanced-balance cookies
port 80
add service ServerB
string skip-length 0
string process-length 6
protocol tcp
vip address 172.16.32.1
activeIt should work.
There is no reason for it not to work...
This is the best method you can have on the CSS for stickyness.
Get a sniffer trace on the client and server with arrowpoint cookie configured on the CSS and capture a failure so we can see what is going on.
also send me the config so I can verify everything is ok.
If you have a service request open with the TAC, you can also give the SR # so I can review what has been done.
Gilles.
Maybe you are looking for
-
How user OID (or other ldap) users with JAAS in my JEE application?
Hy people, I'm developing a JEE application and for secuity I'm using JAAS, but I would like use users from my OID to authenticate. Is it possible? Can someone help me? Thanks!!! Regards,
-
Need help fast just bought sound blaster audigy se c
Hi please anyone help me i just install my new sound blaster audigy se i also disable my onboard sound the problem is i dont get proper 5. surround sound from my speakers it just seem that all the speakers play but dont get the crossover ,I have a ch
-
Need to trigger Save in ME22N - ME_PROCESS_PO_CUST
Hello fellow gurus, Riddle me this: How can I trigger a SAVE in ME22N in the context of BAdI ME_PROCESS_PO_CUST? I have created a custom tab at the Header level so that our users can put data in the fields and populate the fields in the Purcha
-
I watched the first 11 minutes of a movie, paused and then when I tried to play again recieved the error - An error occurred loading this content. try again later. No amount of retrying later fixed the problem. I will not be able to finish watching
-
How wide to make a website in pixels?
Haven't made a website in a WHILE, and I realize the game has changed. How many pixels wide are people designing at these days, as a rule of thumb?