Looks like we are experiencing a similar issue. Did anyone ever resolve??
Any help is much appreciated.
If you can't find better solution, you can have different permutations of SessionIdAlphabet in each node. They are set in jbossweb-tomcat55.sar/META-INF/jboss-service.xml Looking at the SessionID generation code, having these characters (they must be 65, rememeber) permuted in each node will decrease the probabilities of having duplicated session ids... Hope it helps.
First off, thanks to everyone for posting solutions.
Unfortunately, after implementing the alphabet changes, re-verifying the configuration (as suggested above) and adding more verbose logging we continue to have the problem. It turns out, the duplicate IDs are actually occurring on the same node!
Any further help is much appreciated.
Thanks in advance.
We are facing the same problem. Were you able to resolve the issue?
We also were having issues with what seemed to be generation of duplicate sessionIDs. But we were running two JBoss AS/JBossWeb servers in a non-clustered environment.
As a test I logged all generated sessionIDs and found that, over time, of the accumulated 5300 sessionIDs generated on the two servers, 153 of them were created on both servers (duplicates). None were duplicates within the same server though.
So from what I can gather, that is a probable cause for some issues we were having.
A temprorary fix was to make tomcat generate longer sessionId on one of the servers in order to be truly unique.
(sat the sessionIdLength attribute in deploy/jbossweb-tomcat55.sar/context.xml)
I think in order to be even more secure, we need to write some code that prevent anyone from "faking" a sessionID to "steal" another users session.
Found some hints here:http://en.wikipedia.org/wiki/Session_fixation