Monday, 29 June 2009

Session sharing in Apache Tomcat

Share
Sometimes when you want to create large portal-like application which consists of a few smaller applications, or you want to create your own SSO domain, you must share session and session data between all interested applications.

Today I will show you how you can share session and data across applications in Apache Tomcat 6.

Enabling session sharing

Open $CATALINA_HOME/conf/server.xml, find the 8080 connector definition:
<Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" />
and simply add emptySessionPath="true" attribute to it so that it looks something like this:
<Connector port="8080" protocol="HTTP/1.1" emptySessionPath="true" connectionTimeout="20000" redirectPort="8443" />
Test projects

I created two simple applications called session1 and session2.

session1 increments the counter:
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>++</title>
</head>
<body>
<h1>I'm incrementing the counter!</h1>
<c:set var="counter" value="${sessionScope.counter + 1}" scope="session" />
<h1>Current counter value is ${sessionScope.counter}</h1>
</body>
</html>
session2 decrements the counter:
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>--</title>
</head>
<body>
<h1>I'm decrementing the counter!</h1>
<c:set var="counter" value="${sessionScope.counter - 1}" scope="session" />
<h1>Current counter value is ${sessionScope.counter}</h1>
</body>
</html>
Deploying and testing

When I deployed both applications and refreshed a few times their index pages:
http://localhost:8080/session1/
http://localhost:8080/session2/
although the JSESSIONID cookie was the same:

counters were independent. The first one showed +4, the second one showed -4.

The problem and the solution

Problem: even though the session id is the same in both applications you cannot share data directly using HttpSession object.

Solution: you have to use session-aware cross contexts in order to share data between applications.

Cross contexts in Apache Tomcat

First you have to allow applications to access each others' contexts.

Open $CATALINA_HOME/conf/context.xml and add crossContext="true" attribute to the <Context /> root element:
<?xml version='1.0' encoding='utf-8'?>
<Context crossContext="true">
<WatchedResource>WEB-INF/web.xml</WatchedResource>
<Manager pathname="" />
</Context>
Re-start the server.

Cross context data sharing

Please note that I highly loath scriptlets, I only show them in order to simplify the listing :)

Edit index.jsp of the session1 application so that it looks like this:
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>++</title>
</head>
<body>
<%
ServletContext siblingContext = request.getSession().getServletContext().getContext("/session1");
Integer counter = (Integer)siblingContext.getAttribute("counter");
if (counter == null) {
counter = 0;
}
counter++;

request.setAttribute("counter", counter);
siblingContext.setAttribute("counter", counter);
%>
<h1>I'm incrementing counter!</h1>
<h1>Current counter value is ${counter}!</h1>
</body>
</html>
Then, modify the session2 application:
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>--</title>
</head>
<body>
<%
ServletContext siblingContext = request.getSession().getServletContext().getContext("/session1");
Integer counter = (Integer)siblingContext.getAttribute("counter");
if (counter == null) {
counter = 0;
}
counter--;

request.setAttribute("counter", counter);
siblingContext.setAttribute("counter", counter);
%>
<h1>I'm decrementing counter!</h1>
<h1>Current counter value is ${counter}!</h1>
</body>
</html>
Re-deploy both applications.

Now, when you access both applications, you will see that the counter is now shared.

Session-aware cross context data sharing

Didn't you spot anything weird?

I'm sharing data using ServletContext. Its scope is the application scope, not the session scope.

If you open both pages in different browsers you will see that the counter shares its value.

How to make it session-aware?

Since JSESSIONID is the same, you can create a map and use session id as a key to store session data and then store the map in ServletContext like this:
Map<String, Object> data = new HashMap<String, Object>();
String id = request.getSession().getId();
data.put(id, counter);
siblingContext.setAttribute("data", data);
Cheers,
Łukasz

4 comments:

Tom said...

This was very informative. Thanks

Eric Domazlicky said...

Isn't using a Map like that open you up to concurrency issues? Or am I missing something? Example Thread 1 gets the map from application scope, Thread 2 gets the map and updates it before Thread 1 is done, so now the Map is not accurate.

Łukasz said...

Hi Eric,

Frankly, this solution works great for me, I didn't notice any concurrency issues.

Context is application-scope (static), each session has its very own entry in the map.

I don't know Tomcat's implementation details but I don't think that the same user (session) might be processed by two independent threads.

Eric, if you're to investigate it in depth, please do let me know what you find out.

Cheers,
Łukasz

Jai said...

Hai Lukasz,

I had implemented two applications in tomcat. I can able to share the session value between the applications.

But i come across one problem. The session value is open to all systems but not to system it has been created(ie., if i access the application in another system the session is getting shared. Can we able to avoid this

Thanks
Jai