Question

I’ve got website where is one JAVA servlet witch connect to auth-user system, and secound JSP page in iframe witch is connect to other server (Apache Tomcat). Those two are creating session when are connectiong to servers. But when I starts connect with iframe, my JSESSIONID is saved in same cookie file as was created by first servlet. So now I can not connect to auth-user server cause cookie created in first place was changed by iframe and now I have all informations from two servers in one cookie file. How can I resolve this problem? I cant rewrite URL to base sessionID cause I dont know where is it in those application. Maybe I can somehow make Tomcat to save session information in different cookie, and one servlet will get infos from one cookie file and another from secound one? But how can i do this?

Answer 1

It seems you have several Tomcat instances which have the same domain name, and you have session cookie collision. To resolve it you can change Cookie path in Tomcat configuration

<Context ... sessionCookiePath="/some_path_1" > for Tomcat 1
<Context ... sessionCookiePath="/some_path_2" > for Tomcat 2