New session created with every request

Question

Hi there,
I have an web application that we used to deploy on tomcat, websphere and bea without any trouble. We are trying to move to support OAS and the application gives this peculiar behavior:
A new session is created with every single request by the client browser. I have searched these forums for the better part of today and read some interesting similar cases but none of the fixes seem to have any effect on my problem.
Is there a different way I need to request the session object from the request in the app for OAS? Or is there a configuration that I should have? I am deploying the app as a .war file. Is there a better way to deploy on OAS, should I stick the war in a .ear?
Any help on this would be most greatly appreciated!
Thanks,
-Adam

Answer 1

I have a problem that matches with this subject line but its somewhat different. This original posting wants to create new session and invalidate the existing one but my problem is to keep the session invalide if it has expired for the browser.
Anyways, here is my problem. I have JSP named entity_actions.jsp which has 3 pop-up links that opens up with code like:
window.open('restaurantentry.do?entityName=restaurant')
window.open('districtentry.do?entityName=district')
window.open('baseentry.do?entityName=base')
My web.xml has this tag:
<session-config>
<session-timeout>5</session-timeout>
</session-config>
And the way forward the response for each request is:
context.getRequestDispatcher(urlString).forward(request, response);
The code I check for session timeout is:
private void checkForSessionTimeOut(HttpServletRequest request)
throws SessionTimeoutException
HttpSession current_session = request.getSession(false);
logger.info(CLASS_OBJECT, "Session in checkForSessionTimeOut(): "+current_session);
if (current_session == null)
logger.error(CLASS_OBJECT, "SessionTimeOutException has thrown.");
throw new SessionTimeoutException("sessionTimeOut");
Now lets say I want to show the end user session expiry page after 5 mins of idle time. Now from entity_actions.jsp when I click/open any one popup first time after 5 mins of idle time/session expire,
logger.info(CLASS_OBJECT, "Session in checkForSessionTimeOut(): "+current_session);
this loggers shows current_session as 'null' and I can display session exp mesg on the popup page. But when I click/open any other popup or any other link on the page it DOES WORK instead of having current_session = null, it creates new one. And I can see the sessionid which is different than fist session created on the same base page/browser.
The same pattern of code used to work on Tomcat and JRun before for showing consistant session expiry on all the clicks being made on the same browswer after session gets expire.
Why OC4J / JDev 10.1.3 is creating new session on the same browser even after session has expired?
How can I fix this?
Thanks