Jetty 7 won't let me customize session cookie path
Using Jetty 7.0.2, I am unable to set a custom session cookie path.
I am hosting multiple sites on the same server using apache to proxy requests to the appropriate context. (replaced http as htp as stackoverflow thinks my multiple links might be spam)
<VirtualHost *:80>
ServerName context.domain.com
ProxyRequests On
ProxyPreserveHost Off
<Proxy *:80>
Order deny,allow
Allow from 127.0.0.1
</Proxy>
ProxyPass / htp://localhost:8080/context/
ProxyPassReverse / htp://localhost:8080/context/
<Location />
Order allow,deny
Allow from all
</Location>
</VirtualHost>
Jetty is running on the same server on port 8080 and my context is available @ / context
The user accesses the @htp: //context.domain.com application, but jetty sets the path for the session cookie @ / context. This prevents the browser from accessing the cookie because the actual context path is not used. I need to override the default Jetty setting to set the cookie for the context and set the path at the root (/).
In my Jetty webdefault.xml, I have the following which partially works:
<context-param>
<param-name>org.eclipse.jetty.servlet.SessionCookie</param-name>
<param-value>CustomCookieName</param-value>
</context-param>
<context-param>
<param-name>org.eclipse.jetty.servlet.SessionPath</param-name>
<param-value>/</param-value>
</context-param>
The cookie is configured correctly with a custom name, but it does NOT set the SessionPath. No matter what I set the value ... it refuses to set the cookie in any path, but / context.
It was driving me crazy so any help would be greatly appreciated.
a source to share
It looks like you hit this error , causing Jetty to always use the context path for the session cookies.
a source to share
I'm not that familiar with Jetty, but it looks like at some point the client is accessing / The context in which the cookie is created. I would double check the code and make sure your cookie is not being created in the / context of your site. It doesn't matter if your user connects to the root of the domain, the cookie doesn't look at what your user is connected to, it looks where the cookie is generated from.
If your cookie is created from / Context, your user may even access htp: //foobar.domain.com, it will still look like it comes from / Context because it is generated. The only way is to create a cookie at the root level and not on pages from scope / context. This is to prevent cookie monsters from stealing cookie information from sites to which it also does not belong (if you host on your site at foo.yahoo.com and create a cookie, this will support another site. which you do not own (bar.yahoo.com) from viewing your cookie This is by design.
a source to share