A new JSESSIONID is created each time a user runs a servlet request

Diagnostics

Product: WebFOCUS Application and Enterprise Editions

Release: 8205

Primary OS: Windows

Solution Date: 2019-12-27

Problem

A new JSESSIONID is created each time a user runs a servlet request. The audit.log shows multiple logins within seconds for the same user.

Solution

Load balancing using sticky sessions is enabled through configuration settings in the worker.properties file of the Jakarta plugin. The name of the session cookie is set by default to JSESSIONID.

This worked in release 8.1.05 of WebFOCUS because the session cookie name used by WebFOCUS defaulted to JSESSIONID. However, the default session cookie name used by WebFOCUS changed in release 82x to WF-JSESSIONID. As a result, there is a disconnect between the session cookie name used by Tomcat for stickiness and the actual session cookie name being generated. Therefore stickiness ceased to work.

This issue was resolved by updating the worker.properties file to use the session cookie name that is generated in WebFOCUS release 82x (WF-JSESSIONID).

For additional information on configuring the worker.properties file, refer to The Apache Tomcat Connectors - Reference Guide - workers.properties configuration.