CODEWITHSUNDEEP
java
Vinoth Vinoth
Vinoth Vinoth

Reputation: 13

Sharing session data between two war files

I have two war files such as war1 and war2

If am login the application, the session will be created in war1 and from that if am navigate to war2, there i need the same session data.

I tried crossContext=true in context.xml of server from that i can access the data by storing it in servletContext. But the issue is once i logined the screen in chrome the session data will be stored in servletContext and the data will maintain till the application is running.

If am giving the same URL in another browser like IE here also, i can get the servletContext data so instead of navigate to login page the corresponding screen will be opened

Kindly suggest me how can i overcome this issue in java?

Is there any way to findout browser switching or incognito window mode of the browser in java? Note: am using tomcat server

Upvotes: 1

Views: 1585

Answers (2)

Mark Bramnik
Mark Bramnik

Reputation: 42491

While session replication indeed can be done in Tomcat (see here) I really suggest you to avoid this type of issues by eliminating the session altogether.

This session replication is an approach that was somewhat common before ~15-10 years, but nowadays when we have a lot of servers running in parallel to serve user requests and have elastic clusters, this approach is not good enough because basically it doesn't scale well.

There are many ways to achieve what you want, though:

  1. Use a shared database to store the session information. Add some session Id to the response and require the client to pass this id back into all subsequent request along the session. Then execute a query to the Database by this Id and retrieve all the session information. This solution also doesnt really scale well, but then you can shard the session information if the db permits to do so...
  2. Use Redis/Aerospike to save the session information of the currently connected user. somewhat like DB approach, but since redis run in-memory it will be much faster. In general, this approach can be used in conjunction with 1 where redis is an in-memory cache.
  3. Encrypt the session information or even just sign cryptographically and send back to client. Client will have to supply this information along with the request without knowing which server will actually serve this request. Without delving into cryptography I'll just state that encryption can be done if you don't want client to see the session information (despite the fact that this is the user whose information is supplied) and signature is used to prevent tempering the data (while sending it back to server). The data can be supplied to server from client via Header or cookie for instance.

Upvotes: -1

Tim Biegeleisen
Tim Biegeleisen

Reputation: 521457

I have never dealt with your exact configuration problem, but even if you can make this work on a single Tomcat instance, you might have problems should your two web applications ever be distributed across multiple Tomcat instances.

So, I am going to suggest that you actually use a database to store state which needs to be passed between the two applications in a safe and reliable way. Note that the database approach also scales nicely in a distributed environment, so long as you have a single logical database.

Upvotes: 1

Related Questions