Sunday, April 22, 2012

Session lost after switch from HTTPS to HTTP

I notice an issue that http session Id is not unique from single browser. The following debugging code was added for each Spring controller class:

HttpSession session = request.getSession();
logger.debug("Current session id: " + session.getId());

The session id was always same for https access from the browser. And it was changed for http access even with the same browser.

That looks like a well known issue. I should keep https access for all links to my web application if I would like the session being kept.


No comments:

Post a Comment