A
Anusuya
Hi,
I am facing a strange problem. We have enabled SSL based session
tracking with session affinity option as cookies-based tracking on WAS
4.0.5. WebServer is SUN ONE 6.0. The session timeout is set as 10
minutes (in session manager service on WAS console) and no timeout
exists in web.xml. We have also set SSLV3 session timeout on web
server appropriately to suit our session timeout on WAS. Only SSL V3
is enabled on the web server.
Now when we access our application over proxy (iplanet web proxy
server 3.6), we find that current session is lost after some time -
anywhere between 40 seconds to 4 minutes, a new session is created
with a new session id hence our data set in session is lost. And the
previous session is still active. (We have done some cleanup
activities by implementing HTTPSessionBindingListener, and the old
session's expiry happens only after 10 minutes - the timeout set on
WAS) This does not happen if we bypass proxy or change the session
tracking mechanism to cookies.
We also faced a similar problem when the application was accessed
through squid proxy on linux where the session was lost right after
bringing up welcome page after login, and the user cannot proceed to
next pages at all.
In both the above cases, SSL is enabled on respective proxies. And
there is not switching between HTTP and HTTPS protocols in our
application.
Can somebody please throw some light over this issue, is there
anything on proxy that needs to be set for carrying on SSL sessions,
or any parameter on WAS or any programmatic stuff done to be done to
take care of it??
Would greatly appreciate any pointer for solving this problem.
Anusuya
I am facing a strange problem. We have enabled SSL based session
tracking with session affinity option as cookies-based tracking on WAS
4.0.5. WebServer is SUN ONE 6.0. The session timeout is set as 10
minutes (in session manager service on WAS console) and no timeout
exists in web.xml. We have also set SSLV3 session timeout on web
server appropriately to suit our session timeout on WAS. Only SSL V3
is enabled on the web server.
Now when we access our application over proxy (iplanet web proxy
server 3.6), we find that current session is lost after some time -
anywhere between 40 seconds to 4 minutes, a new session is created
with a new session id hence our data set in session is lost. And the
previous session is still active. (We have done some cleanup
activities by implementing HTTPSessionBindingListener, and the old
session's expiry happens only after 10 minutes - the timeout set on
WAS) This does not happen if we bypass proxy or change the session
tracking mechanism to cookies.
We also faced a similar problem when the application was accessed
through squid proxy on linux where the session was lost right after
bringing up welcome page after login, and the user cannot proceed to
next pages at all.
In both the above cases, SSL is enabled on respective proxies. And
there is not switching between HTTP and HTTPS protocols in our
application.
Can somebody please throw some light over this issue, is there
anything on proxy that needs to be set for carrying on SSL sessions,
or any parameter on WAS or any programmatic stuff done to be done to
take care of it??
Would greatly appreciate any pointer for solving this problem.
Anusuya