I have two webshpere apps

(installed on two separate profiles, and both the ports and context roots are different)


  • When logging into app1, users get a JSESSIONID cookie X
  • When logging into app2 in another browser tab (IE8) user gets a JESSSIONID cookie Y


  • When logging into app2, the JSESSIONID cookie value Y overwrites the value X, thus invalidation the session of app1 (user is thrown back to login page if they do anything)


  • Is that the default behavior? it looks weird that two web apps can share a JSESSIONID cookie
  • Is there a way to configure the two web apps to have JSESSIONID cookie isolation?

Those two apps are unaware of each other since they're in separate profiles. So I expect the second one sees a session ID it doesn't recognize, assumes it's an expired one, and creates a new one.

You can change one of the application's cookie name to something other than JSESSIONID or you can change its path so that it is only sent back for /app1 or /app2.

Either server-wide under Servers > Server name > Session Management > Enable Cookies or for the particular application(s) under Enterprise Applications > Application name > Session Management > Enable Cookies. If you choose the latter, you have to also check Override session management.

| improve this answer | |

May be you should set an application specific cookie path so that you restrict the URL a cookie will be sent.

This can be done by enabling Override session management in Enterprise Applications > AppName > Session management and choose Enable cookies > Cookie path > Set cookie path to be equal to the context root of the application e.g. equal to app1 or app2.

To my opinion this is the most preferable way to isolate cookies from apps running in the same host.

| improve this answer | |

There is an alternate (AIUI, preferred?) solution to changing the cookie name or adding a path component -- you can configure both applications to re-use the incoming session ID and base the created session around it.


| improve this answer | |
  • Good link @covener. That technique specifically mentions multiple nodes in the same domain. I'm wondering if it also works across multiple profiles. I'm also wondering if that means that visiting with an old, expired session ID causes that ID to be reused anyway... – dbreaux Jan 30 '13 at 14:39

i had same issue in my environment. Inspite of changing cookie path in both the application's, i had changed only one application cookie path and enabled override session management. issue got resolved after making the change.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.