How to avoid appending -Djboss.node.name value to JSESSIONID cookie in JBoss EAP 7.3

[Jagadeesh N]

Hi All,

 

We migrated our application from JBoss EAP 6.4 to JBoss EAP 7.3. I observed that the value of "-Djboss.node.name"(node1) is appending to the JSESSIONID cookie. 

In our application we have a SessionListener class in which we are storing the sessionids to a static map and while doing any operations we are validating the session id from the map and loading the appropriate data.

 

Please find the below code.

 

In web.xml

<listener>

  <listener-class>com.project.session.ProjectSessionListener</listener-class>

  </listener>

and the code in ProjectSessionListener is

 

public class ProjectSessionListener extends HttpSessionBindingListener{

private static final Map<String, HttpSession> sessionMap = new HashMap<String, HttpSession>();

...............................

@Override

  public void valueBound(HttpSessionBindingEvent event) {

  super.sessionCreated(event);

  final HttpSession session = event.getSession();

  final String sessionId = session.getId();

  sessionMap.put(sessionId, session);

  }

}

While adding the sessionid to sessionMap there is no .node1 appended to the session(ABCD1234), so the sessionid was saved without .node1 in the Map.

 

When we trigger any other request, I observed that .node1 was appended to the JSESSIONID(ABCD1234.node1) in the cookie.

While validating we are trying to get the session from the sessionMap using this JSESSIONID from cookie and it returns null as the key in the map is just with JSessionID without node id.

I tried

1)  removing the  -Djboss.node.name from JBOSS confuguration, in this case it is appending my pc name(ABCD1234.sreenath-WIN-7).

 

Is there any way to avoid appending the extra characters to JSESSIONID on JBOSS EAP 7.3.x?

 

[Paul Ferraro]

Comments inline.

> While adding the sessionid to sessionMap there is no .node1 appended to the session(ABCD1234), so the sessionid was saved without .node1 in the Map.

> When we trigger any other request, I observed that .node1 was appended to the JSESSIONID(ABCD1234.node1) in the cookie.

> While validating we are trying to get the session from the sessionMap using this JSESSIONID from cookie and it returns null as the key in the map is just with JSessionID without node id.

On Thursday, March 18, 2021 at 7:52:47 AM UTC-4 jagade...@gmail.com wrote:

Hi All,

 

We migrated our application from JBoss EAP 6.4 to JBoss EAP 7.3. I observed that the value of "-Djboss.node.name"(node1) is appending to the JSESSIONID cookie. 

In our application we have a SessionListener class in which we are storing the sessionids to a static map and while doing any operations we are validating the session id from the map and loading the appropriate data.

 

Please find the below code.

 

In web.xml

<listener>

  <listener-class>com.project.session.ProjectSessionListener</listener-class>

  </listener>

and the code in ProjectSessionListener is

 

public class ProjectSessionListener extends HttpSessionBindingListener{

private static final Map<String, HttpSession> sessionMap = new HashMap<String, HttpSession>();

Is this a distributed web application?  I assume it is not, otherwise your static map of HttpSession instances will likely result in a memory leak.

 

...............................

@Override

  public void valueBound(HttpSessionBindingEvent event) {

  super.sessionCreated(event);

  final HttpSession session = event.getSession();

  final String sessionId = session.getId();

  sessionMap.put(sessionId, session);

  }

}

While adding the sessionid to sessionMap there is no .node1 appended to the session(ABCD1234), so the sessionid was saved without .node1 in the Map.

This is by design.  Non-distributed web applications will append the routing identifier of the Undertow server to the value contained within the JSESSIONID cookie, which is commonly read and processed by load balancers to handle session affinity.

It is meant to be transparent to the application, which is why your application does not see this value when using the Servlet API.

When we trigger any other request, I observed that .node1 was appended to the JSESSIONID(ABCD1234.node1) in the cookie.

While validating we are trying to get the session from the sessionMap using this JSESSIONID from cookie and it returns null as the key in the map is just with JSessionID without node id.

Why would you try to obtain the session identifier from the JSESSIONID cookie and not from HttpServletRequest.getRequestedSessionId() or HttpSession.getId()?

There is nothing in the servlet specification that dictates that this cookie value must be identical to the value returned by HttpServletRequest.getRequestedSessionId(), thus it is unwise for your application to assume this.

I tried

1)  removing the  -Djboss.node.name from JBOSS confuguration, in this case it is appending my pc name(ABCD1234.sreenath-WIN-7).

This is because,iIf unspecified, jboss.node.name defaults to jboss.host.name, which itself defaults to the host name of the machine. 

Is there any way to avoid appending the extra characters to JSESSIONID on JBOSS EAP 7.3.x?

Yes, but only for distributable web applications (i.e. a web application whose web.xml contains <distributable/>).

See: https://github.com/wildfly/wildfly/blob/18.0.x/docs/src/main/asciidoc/_high-availability/subsystem-support/Distributable_Web_Applications.adoc

You can disable session affinity by default for all distributable web applications using the following CLI operation:

/subsystem=distributable-web/infinispan-session-management=default/affinity=none:add

This can also be applied per-application using the distributable-web deployment descriptor namespace.

[dt pham]

This is what it looks like in your distributable web session of your wildfly configuration:

<infinispan-session-management name="default" cache-container="web" granularity="SESSION">

                <no-affinity/>

</infinispan-session-management>

<no-affinity/> instead of <local-affinity/>