tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Anders Rundgren" <>
Subject Re: Session lost when switching from https to http in Tomcat 4
Date Tue, 26 Mar 2002 10:38:01 GMT
You are right Manuel,

Tomcat 4.0.2 using SSL unfortunately always sets a &Secure flag
on JSESSIONIDs, which do not (depending on browser) allow
you to do this https->http switch.

A Macintosh using IE 5 cannot even obtain a _standard_ SSL jsession due to this.

This is why I have requested this behavior to become an option.

The option would actually disable a cookie-RFC compliant feature,
but so what, if you cannot get things to work?


----- Original Message ----- 
From: "Manuel Mall" <>
To: <>
Sent: Tuesday, March 26, 2002 11:17
Subject: Session lost when switching from https to http in Tomcat 4

Has the session semantic changed between Tomcat 3 and Tomcat 4?

We have a servlet/JSP application in which users establish their servlet
session using https but conduct the rest of their interactions using http.
This works fine under Apache 1.3.22 with Tomcat 3.2.1 connecting using

After upgrading to Tomcat 4.0.3 now using ajp13 the session appears not to
be preserved between https and http, ie. after switching back to http the
request.getSession(false) call returns null.

This seems to indicate that the session tracking mechanism has changed
between Tomcat 3 and Tomcat 4. Can anyone shed light on this for me? Is this
expected? Is there a workaround/configuration/setting in Tomcat 4 I might
have missed?



To unsubscribe:   <>
For additional commands: <>
Troubles with the list: <>

To unsubscribe, e-mail:   <>
For additional commands, e-mail: <>

View raw message