CODEWITHSUNDEEP
apache-flexblazeds
Michael S
Michael S

Reputation: 425

HttpSession Session ID different to FlexSession ID

I have a Flex application which is served via a JSP page. In this page I output the session ID using HttpSession when the page is loaded:

System.out.println("Session ID: " + session.getId());

In a very simple remote object hosted in BlazeDS (called from the flex application using an AMF Channel and standard RemoteObject functionality) I also output the session ID but this time using FlexSession (which as I understand is supposed to wrap around HttpSession).

System.out.println("FlexSession ID: " + FlexContext.getFlexSession().getId());

I would expect both IDs to be the same but this is not the case. The session IDs differ which is causing problems as there is data stored in the HttpSession which I need to be able to access from my remote objects within BlazeDS.

I've exhausted the reading material on BlazeDS and FlexClient/FlexSession/FlexContext but can't see why the FlexSession is not being linked to the HttpSession. Any pointers greatly appreciated.

I feel I must be missing something fundemental here, am I accessing the

Upvotes: 3

Views: 6696

Answers (3)

Michael S
Michael S

Reputation: 425

Thanks to both answers above I finally found the root cause and thought I'd share it on here.

The reason for differing session IDs was to do with the use of SSL for authentication and the use of AMF Channel rather than Secure AMF. Using the channel for the first time caused a new session to be created (hence the different ID) as the existing session related to the secure version of the site.

Silly configuration mistake but worth passing on - make sure that if using SSL that you're also using Secure AMF connecting to the secure endpoint rather than standard AMF or you'll run into the same session ID problems I faced.

Upvotes: 2

Cornel Creanga
Cornel Creanga

Reputation: 5308

I do not think that it is related to the FlashPlayer..is more related to the concept of FlexSession and how BlazeDS/LCDS works. For example you can have an active session even when not using the http channels - when using NIO/RTMP you are bypassing the application server and the http protocol. So it make sense to have an abstract class FlexSession with various implementations.

However when using BlazeDS FlexSession will wrap an HttpSession object internally, and removeAttribute/getAttribute/setAttribute are in fact calling the the same methods from the HttpSession object..so you can access all the data from the HttpSession. If not please provide more details.

However, it will not work when using RTMP channels(which exists only in LCDS by the way), you need to change your design in this case.

Upvotes: 3

Alan Geleynse
Alan Geleynse

Reputation: 25139

Unfortunately this is just how the Flash player works. I have seen this same behavior many times.

The best solution I found was to establish the HTTP session and pass back the session ID. On the client side, you can then pass the session ID to the Flex application. You then send that ID from Flash to the server and use it to look up the existing session or establish a second session.

You will need to do something like this though, I have not been able to find a way to reliably get Flash to use the same session.

Upvotes: 1

Related Questions