JSESSIONID cookie has '.node0' postfix while the server side sessionID doesn't

user_6372391 0
Viewed 2599

I am using shiro for session management. When I get the sessionID in server side it is something like this:

node0sicwaberf0z59o8qpehfpasf6

However, when I check the JSESSIONID in my browser this value is saved as:

node0sicwaberf0z59o8qpehfpasf6.node0

What exactly is this .node0 and why is this appended to the end of sessionID

It is also worth mentioning that I am using jetty 9 as my web server.

shiro jetty cookies java
4 Answers

The format of the Jetty session id (9.3 and onwards) is worker name (e.g. node0), a randomly generated unique ID (e.g. 123x0dsf) and the .worker name (e.g. .node0) according to org.eclipse.jetty.server.session.DefaultSessionIdManager.

Check DefaultSessionIdManager#renewSessionId and DefaultSessionIdManager#getExtendedId.

user_24061370

Session management received a significant overhaul in Jetty 9.4. I faced same issue when I upgraded jetty from 9.3.25.x to 9.4.15.x. Due to addition of worker name in JSESSIONID, in my application some header validation that happens outside of Jetty start failing. As i have only single node of jetty, i choose to remove node id from session ID. I managed to remove .node postfix by adding following lines to start.ini

jetty.sessionIdManager.workerName=
etc/sessions/id-manager.xml

By default, Jetty 9.4.x will instantiate a single instance of the DefaultSessionIdManager and HouseKeeper at startup with default settings. Above configuration overwrites workerName in default configuration.

Reference

user_82801350

I know it's late, but maybe it will help somebody.

I'm using maven-jetty-plugin (9.4.6.v20170531), end experience similar issue - Session.getId() returns one value, but ServletContainer actionally set JSESSIONID cookie to value+'.node0'.

I do not use clustering in any way, and no configuration at all. This is default behaviour of jetty server.

I managed to remove .node postfix by adding following lines to jetty-env.xml:

<Get name="sessionHandler">
  <Call name="getServer" id="srv"></Call>
  <Set name="sessionIdManager">
    <New class="org.eclipse.jetty.server.session.DefaultSessionIdManager">
        <Arg><Ref refid="srv" /></Arg> 
        <Set name="workerName" type="String"></Set>
    </New>
  </Set>
</Get>

Here is related source code of DefaultSessionIdManager

user_20561780
user_64151990
Related