HttpSession not being preserved with Struts 1.1

[Brian J. Sayatovic]

I'm experiencing a problem in Struts 1.1 under WAS4 where the
HttpSession isn't being preserved in some environments.

The user starts by logging in using an HTML form that submits to a
special LoginAction. The Action takes the values from the form,
places them in a User object and places that User object into the
HttpSession. Finally, the Action returns an ActionForward to the main
URL.

That main URL is another Action: MainAction. However, I have a custom
RequestProcessor that looks for necessary authorization information (a
cookie which can be used to put a User object in the HttpSession, or a
pre-existing User object in the Session). If the necessary
information is not found in the HttpSession, it redirects to the login
page.

On my local WSAD test environment, this works perfectly. However, in
my real AIX WAS4 test environment, it never thinks I'm logged in.

I've added a lot of debugging to the various classes and found that a
new HttpSession is being created in MainAction even though one was
already createdin the LoginAction. In each case, I'm using the
following calls:

request.getSession().setAttribute(User.USER, theUser); //
LoginAction
User theUser = (User)request.getSession().getAttribute(User.USER);
// MainAction

The javadocs for the no-arg getSession indicates that it will create
an HttpSession if necessary. It is my belief that the way the webapp
is designed to work, the HttpSession created in LoginAction should be
perfectly accessible to MainAction. However, this is not the case in
my AIX WAS4 environment.

Is there something going on because of the ActionForward that
LoginAction uses to redirect to MainAction that is preventing the
HttpSession from being kept? If so, why does it work as is on my
local WSAD environment (on Windows XP)?

Any ideas?

Regards,
Brian.

 

[Sudsy]

I'm experiencing a problem in Struts 1.1 under WAS4 where the
HttpSession isn't being preserved in some environments.

I was experiencing some really odd behaviour in Struts when I
was trying to manage session creation and invalidation. Seems
that Struts "does its own thing" (details: it create sessions
automagically to hold elements such as the client locale) and
using the HttpSession invalidate method was really messing up
everything. Removing those calls (and migrating to mod_jk from
jserv) solved my problems.
As always, YMMV.

 

[Brian J. Sayatovic]

It turns out, the test server is normally accessed through a web
server that forwards certain requests to the app server. However, the
app server was configured to write its session cookies with respect to
the perceived domain of the browser which was that of the webserver.
When I accessed the appserver directly, the cookies for the session
tracking we're being lost by my browser since the appserver has no
domain.

With that knowledge, I was able to resolve the problem.

Regards,
Brian.