Home/ Questions/Q 981163
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-16T04:29:57+00:00

By default tomcat will create a session cookie for the current domain. If you

  • 0

By default tomcat will create a session cookie for the current domain.

If you are on http://www.example.com, your cookie will be created for http://www.example.com (will only work on http://www.example.com). Whereas for example.com it will be created for .example.com (desired behaviour, will work on any subdomain of example.com as well as example.com itself).

I’ve seen a few Tomcat valves which seem to intercept the creation of session cookies and create a replacement cookie with the correct .example.com domain, however none of them seem to work flawlessly and they all appear to leave the existing cookie and just create a new one. This means that two JSESSIONID cookies are being sent with each request.

I was wondering if anybody has a definitive solution to this problem.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This is apparently supported via a configuration setting in 6.0.27 and onwards:

    Configuration is done by editing
    META-INF/context.xml

    <Context
    sessionCookiePath=”/something”
    sessionCookieDomain=”.domain.tld” />

    https://issues.apache.org/bugzilla/show_bug.cgi?id=48379

    • 0