Re: help - multiple users are getting the same session
Re: help - multiple users are getting the same session
- Subject: Re: help - multiple users are getting the same session
- From: Denis Stanton <email@hidden>
- Date: Thu, 16 Dec 2004 07:21:55 +1300
hi Jean-François
Thank you for your help
On 16/12/2004, at 12:30 AM, Jean-François Veillette wrote:
Maybe a proxy that tries to return the same result as the previous request ?
So first request to :
http://server/cgi-bin/WebObjects/MyApp.woa
would return a page that the proxy would cache, so that the second request to the same url would return the cached result.
- jfv
Yes, that's the effect I am seeing. It is as if something on the server is deciding the return the same response, including the same sessionID, to each new user requesting access. We think the multiple re-use of the same session stops happening after a while. That is, if you wait say ten minutes after the previous login you will get a new session, but if you login really close together you all get the same one.
This shows up in the working day. In the morning the logins may be separated as people start at different times, but when they all come back from the lunch break they are logging in close together.
One theory I considered is that the system administrator might have installed something that caches previous responses from the WebObjects app. I don't know of any such program.
I did try to compare the httpd.conf files, but the one on OS X Server is very different from the one on my local OS X test box.
I noticed that the server where the problem occurs has the line
LoadModule proxy-module
The same line is commented
# LoadModule proxy-module
on my test machine where the problem does not occur.
Is this a bit of sneaky sabotage in Apache? If it was this easy to destroy WebObjects' session model I think it would be well known
regards
Denis
Le 04-12-15, à 05:44, Denis Stanton a écrit :
Hi
I've found a serious problem with my WebObjects application. It has been running for over a year, but over the last few days users have been reporting that the login name, which is displayed at the top of the window, is actually someone else's, not the one they entered.
I didn't believe it but now I've visited the client and seen it for myself. It's worse than they said. The users are actually all being given the same session.
When several users log in within a short space of time the first one gets a new session and then the others are given the same session. The results for the application are catastrophic. It handles vehicle reservations with most of the data for a booking being carried in the session class. There are only a small number of users as the application is only used within the company, but when several of the reservations staff are actively editing the same session things get very untidy very quickly.
I have done some simple tracing and found that createSessionForRequest(...) is not being called when a new user accesses the web server with the URL http://myserver/cgi-bin/WebObjects/MyApp.woa. It is behaving as if each new user was supplying a URL including an existing session ID. I suppose this is what happens when cookies are used, but I have not put in any code for cookies.
It does not happen when I compile and run the application in direct connect mode and it does not seem to happen when I test deploy the application through Apache on my development computer. - Mac OS X 10.3.6, WebObjects 5.2.3
It does happen when the application .woa file is copied over to the remote server which is running OS X Server 10.3.6, WebObjects 5.2.3
I don't have exclusive control of the server. Is it possible that the administrator has changed the configurations so it is holding the session ID and giving it out to anyone who asks? When I have tested the login procedure I have used multiple tabs in Safari to login with different names, and then tried multiple windows in Safari. I am assured it happens with multiple separate computers, both Mac and Windows. Most of these computers would be on a LAN sharing a DSL connection to the server which is remotely hosted. I am told that even the small group of staff connecting from another city may find they are sharing the same session.
Has anybody seen this? It seems to have only happened in the last few days, but I can't imagine what has made it possible.
Thank you for reading such a long message.
Denis Stanton
Denis Stanton
email@hidden
Home: (09) 533 0391
mobile: 021 1433622 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Webobjects-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden
Denis Stanton
email@hidden
Home: (09) 533 0391
mobile: 021 1433622
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Webobjects-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden