1

So I'm working on a Java web application, for which I recently implemented an authentication module that relies on the JSESSIONID cookie to identify users. I was testing on a local tomcat from eclipse and everything worked fine... Until I deployed the application on our VPS (Centos) with a bit of a more advanced setup structure:

  • Apache HTTP Server

  • several virtual hosts

  • said webapp is mounted in a virtual host with mod_jk. It's currently accessed over 'sub.hostname.com/WEBAPP_NAME/home', but should be available with 'sub.hostname.com/home'.

The above setup wasn't such a big issue before the authentication update (btw, access was handled by tomcat's security options before). The old VirtualHost looked like this and worked fine:

<VirtualHost *:80>
    ServerName sub.hostname.com
    RewriteEngine on
    RewriteRule ^/(.+)$ /WEBAPP_NAME/$1 [L,PT]
    RewriteRule ^/$ /WEBAPP_NAME/home [L,PT]
    JkMount /* worker
</VirtualHost>

The Issue: After deployment, authentication would not work because the JSESSIONID cookie was not written. I removed the RewriteRules and accessed the application over 'sub.hostname.com/WEBAPP_NAME/home', where everything worked fine again and I received a cookie. From these observations, I guess that the issue is because of the URL being rewritten and the Servlet not writing the cookie to the correct path (?) If that's the case, should I try to write the cookie to some other path from within the application?

The Question: I'm open to all suggestions regarding a solution. Please bare with me, as I'm (obviously) not an expert with server setups. Are there any specific settings to look out for in apache or tomcat that can handle this? Or did I initially choose a wrong setup architecture?

Thanks a lot in advance!

0

You have several choice to change the cookie path.

The problem here is the rewrite_rule in your apache conf and tomcat settting the cookie path to /WEBAPP_NAME/.

In tomcat you can change the cookie path with the sessionCookiePath attribute on the context.

You could also deploy your webapp to / by renaming the war to ROOT.war.

And it may be possible mod_rewrite could be used to change the cookie path.

  • Thanks for the answer! It helped me with my further research as I had more concrete information on what to look for. I found instructions on how to change the cookie path from apache with mod_headers (link and solution in my answer to my own question) – sldk Jun 18 '14 at 17:45
0

I did some more research after reading CédricC's suggestions and found this: Configuring Apache, Tomcat, mod_jk and mod_rewrite to serve up tomcat from top-level

I followed the instructions by Kevin Loney to modify the http headers directly from Apache by using the mod_headers module.

In the end I just had to add the following line to my VirtualHost configuration, which changes all cookie paths from /WEBAPP_NAME to / (root):

Header edit Set-Cookie "^(.*; Path=)/WEBAPP_NAME/?(.*)" $1/$2

Alternative method - change cookie path from Tomcat:

I also tested setting the cookie path from Tomcat in the web.xml of my application:

<session-config>
    <session-timeout>30</session-timeout>
    <cookie-config>
        <http-only>true</http-only>
        <path>/</path> <!-- changes the path -->
        <name>COOKIENAME</name>
    </cookie-config>
</session-config>

Got the web.xml example from the question at https://stackoverflow.com/questions/12755499/how-to-change-jsessionid-cookie-path-to-server-root-in-spring-app-on-jetty

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.