New HttpSession object every HTTP request

I am having a weird problem where the Tomcat server gives out a new session cookie every request, so all my JSPs have a new, empty session every time they run, so I can't store anything!
I have set up the following little test JSP:
<%
Date created = new Date(session.getCreationTime());
Date accessed = new Date(session.getLastAccessedTime());
int i = session.getMaxInactiveInterval();
out.println("ID " + session.getId() + "<br>");
out.println("timeout: " + i + "<br>");
out.println("Created: " + created + "<br>");
out.println("Last Accessed: " + accessed + "<br>");
%>
And it gives a different session ID, and new session creation time every
time I refresh the page.
The web.xml has a session timeout of 1 hour.
But 2 consecutive refreshes get:
ID 9A74C902F25A33B61DAB7CDCA1C0FD57
timeout: 3600
Created: Mon Jun 09 14:49:35 BST 2003
Last Accessed: Mon Jun 09 14:49:35 BST 2003
follwed by:
ID 30AFCD9986223FF0B9E502C2D8D6724C
timeout: 3600
Created: Mon Jun 09 14:49:49 BST 2003
Last Accessed: Mon Jun 09 14:49:49 BST 2003
Of course this is screwing me up because I want to store things in the
session context! Can anyone help???
Thanks,
Nige

Cookies are enabled. I have snooped at the HTTP traffic, and the last session cookie that the server sent is returned by the browser in every request. The server then spews out a new one when it replys!
I'm using Tomcat 5.
I'll try downloading the latest release of V4.
Cheers,
Nige

Similar Messages

A new socket for every http-request?

Do I have to make a new socket for every http-request? The code below doesn't work because it is two requests in a row. The first GET works, but the second doesn't. I thought that the purpose of a socket is that you set it up once and then you should be able to do arbitrary communication between the two peers. Maybe that is just the case with sockets only but not if you use sockets to perform http.
Thank you for your answers! Nice greetings from Austria (not Australia)!
Stefan :)
package httptest;
import javax.net.ssl.*;
import java.io.*;
import java.net.*;
public class Conn2 {
    private PrintWriter out;
    private BufferedReader in;
    private Socket socket;
    public Conn2()
        try {
         socket = new Socket("www.google.at", 80);
         out = new PrintWriter(new BufferedWriter(new OutputStreamWriter(socket.getOutputStream())));
         if (out.checkError())
          System.out.println("SSLSocketClient: java.io.PrintWriter error");
         in = new BufferedReader(new InputStreamReader(socket.getInputStream()));
            System.out.println("Connect erfolgreich.");
     } catch (Exception e) {
         System.err.println(e);
    public void test()
        String inputLine;
        // 1. GET
        out.println("GET / HTTP/1.0");
     out.println();
     out.flush();
     try
            while ((inputLine = in.readLine()) != null)
                System.out.println(inputLine);
        catch(IOException e)
            System.err.println(e);
        // 2. GET
        out.println("GET / HTTP/1.0");
     out.println();
     out.flush();
        try
            while ((inputLine = in.readLine()) != null)
                System.out.println(inputLine);
        catch(IOException e)
            System.err.println(e);
}

Normally in the HTTP protocol, the server will close the connection after every request. So after you do the first GET, the server sends you the result and closes the connection. You have to open a new connection for the second GET.
You can set specific headers to keep the connection open, which makes things faster if you have to do multiple GET's quickly after another. Lookup the specification of the HTTP protocol on http://www.ietf.org/
Maybe it's easier to use a HTTP client library like Apache's HTTPClient: http://jakarta.apache.org/commons/httpclient/ so that you don't have to implement all the difficulties of the HTTP protocol yourself.

Session replication at every http request

Hi everybody
I'm trying to use ZKoss Framework (www.zkoss.org) to develop a
web application and deploy it in a Clustered WebLogic Server.
The main issue I'm facing is that the "state" of the visual interface
is stored inside the http session, and so, when node that handle
the http request changes, the state is resetted and then the page changes,
even if there was no user intervention.
So I need to replicate the whole session at every http request,
to prevent strange behaviours when the request handler node's changes.
Do you know some settings that will force WebLogic Server to replicate the whole
session at every http request?
Thanks in advance.
bye.

Hi Marco,
Yes, You are right But You NEED NOT to put setAttribute("key","value")...code in all your JSPs. because if the Attribute data of Session is changed then Automatically it will be replicated (only the Changed Data and not the Data which is unchanged). Even we need not to worry about replicating the Unchanged Data Again...And WebLogic will take care of ChangedData by itself. There is no other alternate solution available in weblogic to do this...Even no such similar Element available in Deployment descriptors as well.
Actual Link is Broken http://download-llnw.oracle.com/docs/cd/E13222_01/wls/docs90/cluster/failover.html
Any way i am copy-pasting few Lines from E-Docs (the actual link i am not able to find ..but may be u can open the cached page:
http://74.125.153.132/search?q=cache:bxTbqJEsQTsJ:download-llnw.oracle.com/docs/cd/E13222_01/wls/docs90/cluster/failover.html+setAttribute+Session+replication+weblogic&cd=6&hl=en&ct=clnk&gl=in
---------------------------If you are not able to open the link then please refer to the E-Docs copy-paste content below --------------------------
Programming Considerations for Clustered Servlets and JSPs
This section highlights key programming constraints and recommendations for servlets and JSPs that you will deploy in a clustered environment.
Session Data Must Be Serializable
To support in-memory replication of HTTP session states, all servlet and JSP session data must be serializable.
Note: Serialization is the process of converting a complex data structure, such as a parallel arrangement of data (in which a number of bits are transmitted at a time along parallel channels) into a serial form (in which one bit at a time is transmitted); a serial interface provides this conversion to enable data transmission.
Every field in an object must be serializable or transient in order for the object to be considered serializable. If the servlet or JSP uses a combination of serializable and non-serializable objects, WebLogic Server does not replicate the session state of the non-serializable objects.
Use setAttribute to Change Session State
In an HTTP servlet that implements javax.servlet.http.HttpSession, use HttpSession.setAttribute (which replaces the deprecated putValue) to change attributes in a session object. If you set attributes in a session object with setAttribute, the object and its attributes are replicated in a cluster using in-memory replication. If you use other set methods to change objects within a session, WebLogic Server does not replicate those changes. Every time a change is made to an object that is in the session, setAttribute() should be called to update that object across the cluster.
Likewise, use removeAttribute (which, in turn, replaces the deprecated removeValue) to remove an attribute from a session object.
Note: Use of the deprecated putValue and removeValue methods will also cause session attributes to be replicated.
Thanks
Jay SenSharma
Edited by: Jay SenSharma on Feb 11, 2010 10:24 PM
Edited by: Jay SenSharma on Feb 11, 2010 10:26 PM

Peer not authenticated exception on every SSL request

I'm using VeriSign-issued SSL certificates and WebLogic appears to be working fine with them. No browser issues, no server errors -- unless I enable SSL debugging. We were investigating an earlier issue (See: Extremely slow Apache 2.2-WebLogic 12c proxy behavior when using SSL) and we noticed that with every SSL request, we see the following error in the weblogic-server.log:
####<Nov 18, 2013 3:46:52 PM CST> <Debug> <SecuritySSL> <zlxv8131.vci.att.com> <CASWEBAdminServer> <ExecuteThread: '1' for queue: 'weblogic.socket.Muxer'> <<WLS Kernel>> <> <> <1384811212294> <BEA-000000> <Exception processing certificates: peer not authenticated
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
        at sun.security.ssl.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:397)
        at weblogic.servlet.provider.WlsSecurityProvider.getSSLAttributes(WlsSecurityProvider.java:203)
        at weblogic.servlet.internal.VirtualConnection.initSSLAttributes(VirtualConnection.java:163)
        at weblogic.servlet.internal.VirtualConnection.init(VirtualConnection.java:74)
        at weblogic.servlet.internal.ServletRequestImpl.initFromRequestParser(ServletRequestImpl.java:300)
        at weblogic.servlet.internal.HttpConnectionHandler.dispatch(HttpConnectionHandler.java:558)
We continue to see this for every HTTPS request -- every initial GET for the page, and all GETs for associated scripts, images, stylesheets, etc.
This is WebLogic 12.1.1.0 on Red Hat Enterprise Linux 6. I have the following startup options set:
-Dweblogic.StdoutDebugEnabled=true
-Dssl.debug=true
-Dweblogic.security.SSL.nojce=true
-Dweblogic.security.SSL.ignoreHostnameVerification=true
-Dweblogic.security.SSL.enforceConstraints=off
Is this actually a concern, given that we only see it when extended SSL debugging is enabled? When I Google (or search the Oracle forums) for this error, I find only my earlier posting, or folks dealing with self-signed certificates. Surely this is a more common issue. We are experiencing it on several different WebLogic installations on different servers. Exact same error on every SSL request, yet the page renders fine and there are no processing errors or delays -- just the debugging error above.
Any assistance would be much appreciated!
--sam

I using WebLogic 12.1.2 and having the same problem.
<Dec 5, 2013 3:13:01 PM SGT> <Debug> <SecuritySSL> <BEA-000000> <Exception processing certificates: peer not authenticated
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
        at sun.security.ssl.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:397)
        at weblogic.servlet.provider.WlsSecurityProvider.getSSLAttributes(WlsSecurityProvider.java:222)
        at weblogic.servlet.internal.VirtualConnection.initSSLAttributes(VirtualConnection.java:165)
        at weblogic.servlet.internal.VirtualConnection.init(VirtualConnection.java:75)
        at weblogic.servlet.internal.ServletRequestImpl.initFromRequestParser(ServletRequestImpl.java:303)
        at weblogic.servlet.internal.HttpConnectionHandler.dispatch(HttpConnectionHandler.java:570)
        at weblogic.servlet.internal.MuxableSocketHTTP.dispatch(MuxableSocketHTTP.java:119)
        at weblogic.socket.JSSEFilterImpl.dispatch(JSSEFilterImpl.java:216)
        at weblogic.socket.MuxableSocketDiscriminator.dispatch(MuxableSocketDiscriminator.java:186)
        at weblogic.socket.JSSEFilterImpl.dispatch(JSSEFilterImpl.java:216)
        at weblogic.socket.SocketMuxer.readReadySocketOnce(SocketMuxer.java:996)
        at weblogic.socket.SocketMuxer.readReadySocket(SocketMuxer.java:928)
        at weblogic.socket.NIOSocketMuxer.process(NIOSocketMuxer.java:507)
        at weblogic.socket.NIOSocketMuxer.processSockets(NIOSocketMuxer.java:473
        at weblogic.socket.SocketReaderRequest.run(SocketReaderRequest.java:30)
        at weblogic.socket.SocketReaderRequest.execute(SocketReaderRequest.java:
43)
        at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:147)
        at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:119)
>
The page renders fine but when I use t3s connection (for ssl) as following:
Context oContext ;
Hashtable <String,String> oHashtable = new Hashtable<String,String>();
oHashtable.put(Context.INITIAL_CONTEXT_FACTORY, "weblogic.jndi.WLInitialContextFactory");
oHashtable.put(Context.PROVIDER_URL, "t3s://localhost:7002");
oContext = new InitialContext(oHashtable);
I will get the following error:
<Dec 5, 2013 3:19:09 PM SGT> <Debug> <SecuritySSL> <BEA-000000> <[Thread[Execute
Thread: '0' for queue: 'weblogic.socket.Muxer',5,Thread Group for Queue: 'weblogic.socket.Muxer']]weblogic.security.SSL.jsseadapter: SSLENGINE: Exception occurred during SSLEngine.unwrap(ByteBuffer,ByteBuffer[]).
javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
        at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1619)
        at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1587)
        at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1756)
        at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1060)
        at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:884)
        at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:758)
Please help on this. Thanks.

Parsing a http request

i got to parse every http request from the browser in the client machine as a part of my project. i had already posted this query in the forum and got the reply as follows......
*"First you need to put your code between the browser and the network.*
*So your code needs to open a socket on port 80 (the standard http port) and a server socket at the proxy port - you can choose any post but proxies often use 8080.*
*Configure your browser to connect via a proxt using localhost:8080.*
*Then you code has to listen for requests on the server socket and pass them on to port 80, and route the responses back.*
*Once you have that going, you will be able to start to parse the requests."*
But im already connected in a LAN which passes each request through a proxy...... so what should i do now to catch the http requests.......

There can be multiple proxies. Setup your new proxy server to use the existing proxy server, then reconfigure your browser to use the new proxy server.
Also, rather than writing your own proxy server, you should look at downloading an existing one. I believe Apache can be set up as a proxy server. Also I'll bet there are plenty of lightweight proxy servers written in a variety of languages on sourceforge.net. I think there may be one in the Python standard library.

Append email to http request

Hello,
One of the features that RIM allowed us to use was the ability to attach the user's blackberry email and device id to every http request that came through the BES (Blackberry Enterprise Server). Now that we are exploring the iPhone as an option, I was wondering if anyone knew of an equivalent feature within the iPhone enterprise features.
Thanks, Kyle

Thanks LenH, and I agree, my wording is a bit vague.
Here's basically what happens. User's blackberry is setup to use our BES. As such, browser requests from his blackberry go to Verizon/Sprint/Wherever towers and then to our BES server. At this point, if the request is to an internal website, the BES appends the user's email and blackberry id (rim-device-email and rim-device-id) to the HTTP request packet. The BES then sends the request onto the internal webserver. The web app picks up the request and sees that the request has these additional variables and can do certain activities (like authentication) with it.
Does this help?

Setting the header in http request object

I am facing a problem while trying to test a particular flow of my application.The details are given below:
The controller servlet of my main application reads the header "Referer" from the request object and then based on this it forwards the request to appropriate servlets.For testing my application I am writing a test servlet which receives a request object from a test jsp and sets all the necessary attributes in the request object and passes this request object to the doGet () method of the main application's controller servlet. But while trying with this I find that the main controller fails to forward to the correct servlet because it receives incorrect referer information. So my question is how can I set my customised "Referer" in the header of the http request so that the application's controller servlet forwards to the correct servlet?Is there any means to set the request header in servlet or jsp?

As far as I know you can't change the request in a servlet or .jsp, but you can in a Filter. Wrap the original request object in a wrapper class before passing it to chain.doFilter().

HTTP request/response object not thread safe.

According to the serlvet spec. Http Request/Response
are not thread safe. Quoting from the Spec:
" Implementations of the request and response objects are not guaranteed to be thread safe. This means that they should only be used within the scope of the request handling thread. References to the request and response objects must not be given to objects executing in other threads as the resulting behavior may be nondeterministic."
This has prompt me to ask the following question.
For Example I have a servlet which does the following
request.setAttribute("myVar","Hello");
The request and response is dispatched(using RequestDispatch.include(request,response)) to another
servlet which retrieve this attribute i.e request.getAttribute("myVar");
Is this safe?
The Spec only said "The Container Provider must ensure that the dispatch of the request to a target
servlet occurs in the same thread of the same VM as the original request." I take this meaning that the targeting servlet does not have to run in the same thread(only dispatch), otherwise it would be safe.

To put it another way, you can only have onle thing working on a request at a time. For instance, the ServletContext is available to all servlets running on a server. If you tried to save a particular request to the ServletContext, it would potentially be available to many concurrently running servlets. They could all change whatever in it at the same time. Each servlet is in its own running thread. Hope that helps some.

Filter to convert HTTP request to JNLP arguments fails every other time

I want to pass HTTP request parameters to a Java Web Start program as arguments. I have implemented a filter which adds the arguments from the request parameters using XML DOM, and I also set the Last-Modified date to the current date/time. [ I am sort of thinking I should put the date as the file date -- not sure ]
The filter works successfully ever other time I invoke a given URL. If I switch parameters, it looks like the filter works every time.
When the filter works, there are HTTP GET and HEAD requests. When the filter fails, there are three HEAD requests and one GET request. Using the apache soap TCP Tunnel/Monitor, it looks like the HTTP request parameters aren't being passed for the second GET.

Varad and Sc0tt,
Thank you both for your responses.
Varad – Yes, I can/will reduce the amount of data so it does not cause the tabular form to go over the 2000 field limit. If that is not possible, I will at least make the users aware of this issue. Since the same data is used for the other pages in the application, the users might want to keep all the data.
Sc0tt – thanks for providing the information for your environment and settings. To plan for the future, we will have to set the value to something high also, around 8-10K range, and adjust later if we have to.
Thank you both, I will mark both of your answers as helpful and the question as being answered.
DP
(Have either of you used the jquery datepicker solution? If yes, can you please take a look at my thread: Thread: Jquery Datepicker calendar problem with page scrolling
Jquery Datepicker calendar problem with page scrolling

Air application throws security alert every time 'HTTPS' request made to server.

Have a look at the following screenshot.
On click of next button, application internally sends an https request. Appliction throws Security Alert dialog. The text can also be seen clearly.
Strange thing about this alert dialog is that, it appears every time when application send a request in given session.
If I run the same thing in flex (i.e. in browser), it asks for SSL handshake and that is also only once. So why it is happening here in case of Air.
Regards,
Prithvee Zankat.

Back up all data. From the Safari menu bar, select
Safari ▹ Reset Safari...
Check these boxes:
Clear history
Remove all website data
Uncheck all other boxes. Press return. Test.
If Safari crashes immediately on launch and you can't do as above, hold down the shift key and launch it by clicking its icon in the Dock, then try. Failing that, ask for guidance.

Simultaneous remote object calls in one http request?

I am noticing when I have two remote object calls happen at the same time they are being bundled into one http request. This is causing problems in my application becuase the result is not coming back until both have finished.
So basically I have to calls that happen at the sametime. One does not take anytime and the other is a long running task. I will not get the result for the first until the long running task completes.
Has anyone else seen this?
Any help would be appreciated.

"suspend the main thread, pending a remote call.." No. Can't
be done.
..."pass arguments into the resultHandler..." Yes, this is
done using the AsyncToken. (ACT pattern)
The send() methods returns an AsyncToken object. You can use
this dynamic object to add almost anything you want to the token,
including strings, and functions (google the term "closure").
As I am still not comfortable with anonymous functions, I
like to pass strings. I pass an identifier, which I can use in a
switch statement to determine the next step. Sometimes I pass a
"nextStep" string to define finer grain conditionality.
I use a single dataService object and result handler function
for all calls.
Tracy

Object to trigger an HTTP request

I'm looking for an ABAP object that will trigger an HTTP request without bringing it up in the Internet Explorer?

Hi,
Please check this sap help link..
http://help.sap.com/SAPHELP_NW04S/helpdata/EN/1f/93163f9959a808e10000000a114084/content.htm
Thanks
Naren

Airport Extreme requests new IP almost every hour

I bought a new TV (Samsung)that accesses the internet. I have an airport extreme setup with a password. Almost everyday I have to tell the TV the password again. I called the TV manufacturer (Samsung) and asked what to do. They said to get a static IP address from my internet provider. I called my internet provider. They said that my router was requesting a new IP almost every hour.
Is there a way to stop the airport extreme from doing this?
My cable modem (Motorola) and airport extreme are left ON 24/7

Do you have Comcast as your ISP by any chance? I have been experiencing some problems with my AEBSn and comcast as well. I've read in some other threads that there is something about Airport wireless routers and Comcast dynamic DHCP. Comcast will tell you that it's not their problem because if you can connect to the internet by plugging your computer directly into your cable modem using an ethernet connection, then it's not the modem. Apple will tell you it's your ISP not giving your wireless router a good IP. after countless hours of being on the phone with Apple and Comcast and rebooting my modem and AEBSn several different times and ways, someone at Comcast FINALLY told me to do something that worked. Here's what I did. Maybe it'll work for you:
With my computer on, the AEBSn on, and the cable modem on, First, Unplug your cable modem. Wait 10 seconds and then plug it back in and wait for the lights to come back on (not sure what kind of modem you have, but there will be a couple of lights that should come on and be steady and at least one light that will come on and flicker a bit).
Next, unplug your AEBS and leave it unplugged,
Next, restart your computer.
Next, plug the AEBS back in WHILE your computer is starting up. Don't wait for it to completely start up. (I plugged mine back in right after I heard the "bong" sound when my Mac was starting back up.)
That worked for me at least.
your IP address on your AEBS will still seem like it's not right but at least it works (hopefully).
Good Luck!
Message was edited by: David Hard
Message was edited by: David Hard

New instance for every request to Servlet

I want to create new instance for every request to Servlet ...
I am running my servlet on weblogic

Hi!
what functionality can there be that has to be put into init()?
Another idea:
why not include your needed functions in a private method within the servlet and call this method from init() and from doPost/doGet so it is processed any time the servlet is called?
btw: more instances of the same servlet seems to me as going back to the roots (cgi).
Thomas.

New session created with every page request

Hi,
I have an application running in portal framset. A user logins into a portal and has access to several applications, that are displayed in a frameset. My application is creating a new session for every page in the application. Of course, I can't keep session variables and a large amount of sessions are being created. What could be the reason for this, and is there a work around?
Thanks.

There is a chance the you have cookies turned off. Sessions are maintained via a jsessionid which is stored in a user cookie. If you (or another user) don't use cookies, then the session will be lost.
To fix this, every URL you use must be encoded, such that, if cookies are not used, the jsessionid is attached to the end of the URL. If you are using JSTL, the easiest way to do this is like this:
<c:url var="formAction" value="someOtherPage.jsp"/>
<form action="<c:out value="${formAction}"/>" method="GET">
<c:url var="nextPage" value="nextInLine.jsp"/>
<a href="<c:out value="${nextPage}"/>">Next</a> Or if you are not using JSTL, you can use scriptlets:
<%
String formAction = response.encodeURL("someOtherPage.jsp");
%>
<form action="<%= formAction %>" method="GET">
<%
String nextPage = response.encodeURL("nextInLine.jsp");
%>
<a href="<%= nextPage %>">Next</a>

New HttpSession object every HTTP request

Similar Messages

Maybe you are looking for