So I'm working on a Java web application, for which I recently implemented an authentication module that relies on the JSESSIONID cookie to identify users. I was testing on a local tomcat from eclipse and everything worked fine... Until I deployed the application on our VPS (Centos) with a bit of a more advanced setup structure:
Apache HTTP Server
several virtual hosts
said webapp is mounted in a virtual host with mod_jk. It's currently accessed over 'sub.hostname.com/WEBAPP_NAME/home', but should be available with 'sub.hostname.com/home'.
The above setup wasn't such a big issue before the authentication update (btw, access was handled by tomcat's security options before). The old VirtualHost looked like this and worked fine:
<VirtualHost *:80> ServerName sub.hostname.com RewriteEngine on RewriteRule ^/(.+)$ /WEBAPP_NAME/$1 [L,PT] RewriteRule ^/$ /WEBAPP_NAME/home [L,PT] JkMount /* worker </VirtualHost>
The Issue: After deployment, authentication would not work because the JSESSIONID cookie was not written. I removed the RewriteRules and accessed the application over 'sub.hostname.com/WEBAPP_NAME/home', where everything worked fine again and I received a cookie. From these observations, I guess that the issue is because of the URL being rewritten and the Servlet not writing the cookie to the correct path (?) If that's the case, should I try to write the cookie to some other path from within the application?
The Question: I'm open to all suggestions regarding a solution. Please bare with me, as I'm (obviously) not an expert with server setups. Are there any specific settings to look out for in apache or tomcat that can handle this? Or did I initially choose a wrong setup architecture?
Thanks a lot in advance!