Session sharing between contexts doesn't work

Question

Based on the below SO post, I am trying to share session between two application contexts (on the same Tomcat instance).

Sharing session data between contexts in Tomcat

I have created two webapps like the following to test this. (Each webapp contains only a servlet and a web.xml)

WebApp-1 Servlet

public class App1Servlet extends HttpServlet
{
    @Override
    public void doGet(HttpServletRequest request, HttpServletResponse response){
        HttpSession session = request.getSession(true);
        session.setAttribute("message", "hello");
        try{
            response.getOutputStream().print("session value set");
        }catch(Exception e){}
    }
}

Webapp-1 web.xml

<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" id="WebApp_ID" version="3.0">
  <display-name>app1</display-name>

  <servlet>
    <servlet-name>app1servlet</servlet-name>
    <servlet-class>session.test.App1Servlet</servlet-class>
  </servlet>

  <servlet-mapping>
    <servlet-name>app1servlet</servlet-name>
    <url-pattern>/</url-pattern>
  </servlet-mapping>

  <session-config>
    <cookie-config>
        <name>APPSESSIONID</name>
        <path>/</path>
    </cookie-config>
  </session-config>

</web-app>

WebApp-2 Servlet

public class App2Servlet extends HttpServlet
{
    @Override
    public void doGet(HttpServletRequest request, HttpServletResponse response){
        HttpSession session = request.getSession(false);

        try{
            if(session != null){
                response.getOutputStream().print(""+session.getAttribute("message"));
            } else {
                response.getOutputStream().print("session is null");
            }
        }catch(Exception e){}
    }
}

Webapp-2 web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" id="WebApp_ID" version="3.0">
  <display-name>app2</display-name>

  <servlet>
    <servlet-name>app2servlet</servlet-name>
    <servlet-class>session.test.App2Servlet</servlet-class>
  </servlet>

  <servlet-mapping>
    <servlet-name>app2servlet</servlet-name>
    <url-pattern>/</url-pattern>
  </servlet-mapping>

  <session-config>
    <cookie-config>
        <name>APPSESSIONID</name>
        <path>/</path>
    </cookie-config>
  </session-config>
</web-app>

Now if I fire the following http requests one after another, the second request need to print "hello", But the second request is always printing "session is null"

http://localhost/app1
http://localhost/app2

Can anybody please point out what is wrong here? (My web.xml is at version 3.0)

I am developing a social-networking kind of webapp. I am planning to create the UI part as one webapp and back-end as a restful service webapp and planning to deploy both webapps to the same tomcat instance. Can anybody suggest this is a right approach?

Answer 1

For Tomcat 8 (may also work for Tomcat 7) I use the following configuration to share a session across 2 webapps:

conf/context.xml

<Context sessionCookiePath="/">

    <Valve className="org.apache.catalina.valves.PersistentValve"/>
    <Manager className="org.apache.catalina.session.PersistentManager">
        <Store className="org.apache.catalina.session.FileStore" directory="${catalina.base}/temp/sessions"/>
    </Manager>

    ...

</Context>

I deploy the same simple webapp twice log.war and log2.war:

/log
/log2

I can now log-in to /log and have the user displayed in /log2, this does not work with the tomcat default configuration.

The session value is set and read:

HttpSession session=request.getSession();  
session.setAttribute("name",name);

HttpSession session=request.getSession(false);  
String name=(String)session.getAttribute("name");  

I used this project as example: https://www.javatpoint.com/servlet-http-session-login-and-logout-example

Most examples/solutions use a in-memory database which requires more setup work:

• redis
• hazelcast

Answer 2

Sessions are never shared between web applications although session IDs might be depending on configuration. When an ID is shared sessions are created in each web application in the normal manner but they will share a common ID.