-
1. Re: Duplicate sessionIds in cluster
mji0866 Mar 21, 2007 10:05 AM (in response to anre42)Looks like we are experiencing a similar issue. Did anyone ever resolve??
Any help is much appreciated.
Michele -
2. Re: Duplicate sessionIds in cluster
raist_majere Mar 21, 2007 6:43 PM (in response to anre42)If you can't find better solution, you can have different permutations of SessionIdAlphabet in each node. They are set in jbossweb-tomcat55.sar/META-INF/jboss-service.xml Looking at the SessionID generation code, having these characters (they must be 65, rememeber) permuted in each node will decrease the probabilities of having duplicated session ids... Hope it helps.
-
3. Re: Duplicate sessionIds in cluster
jfclere Mar 22, 2007 4:41 AM (in response to anre42)Look to http://www.jboss.org/wiki/Wiki.jsp?page=UsingMod_jk1.2WithJBoss
Do the part of jboss that way the sessionid can't be duplicated:
with a different node_name for each node.
true -
4. Re: Duplicate sessionIds in cluster
mji0866 Apr 10, 2007 1:30 AM (in response to anre42)First off, thanks to everyone for posting solutions.
Unfortunately, after implementing the alphabet changes, re-verifying the configuration (as suggested above) and adding more verbose logging we continue to have the problem. It turns out, the duplicate IDs are actually occurring on the same node!
Any further help is much appreciated.
Thanks in advance.
Michele -
5. Re: Duplicate sessionIds in cluster
g2293 Apr 18, 2007 6:13 AM (in response to anre42)We are facing the same problem. Were you able to resolve the issue?
-Kalyan -
6. Re: Duplicate sessionIds in cluster
twistah Apr 25, 2007 10:06 AM (in response to anre42)Hello !
We also were having issues with what seemed to be generation of duplicate sessionIDs. But we were running two JBoss AS/JBossWeb servers in a non-clustered environment.
As a test I logged all generated sessionIDs and found that, over time, of the accumulated 5300 sessionIDs generated on the two servers, 153 of them were created on both servers (duplicates). None were duplicates within the same server though.
So from what I can gather, that is a probable cause for some issues we were having.
A temprorary fix was to make tomcat generate longer sessionId on one of the servers in order to be truly unique.
(sat the sessionIdLength attribute in deploy/jbossweb-tomcat55.sar/context.xml)
I think in order to be even more secure, we need to write some code that prevent anyone from "faking" a sessionID to "steal" another users session.
Found some hints here:http://en.wikipedia.org/wiki/Session_fixation