quote:

---

> Hello. I am having problems with session information. I have a login servlet
> (LoginServlet) and a welcome page for logged in users (Welcome.jsp). The
> user is asked to enter his user and password in Login.jsp, which in turn
> passes that data to the LoginServlet. If the user is authenticated
> succesfully, I add user information (mainly his userID, name, etc.) to the
> session object. I then forward the request to Welcome.jsp which displays his
> info, options, links, etc.
>
> This works fine 99% of the time, but sometimes it goes nuts on me. I've had
> cases where 2 different users login on different computers and get the same
> "information". What I mean is that John and Mary login and Welcome.jsp says
> "Hello, John" to both of them. While debugging this problem I found that the
> session ID was the same on both browsers (keep in mind that the browsers are
> running on completely different machines).
>
> Is this a thread synch issue or is this a known issue with WAS5?
>
> Any help on the matter would be greatly appreciated, thanks in advance,
> -JG
>
>

---

quote:

---

> Juan Gabriel Del Cid wrote:
> hallo Juan,
>
> i have the same problem and It's driving me cray too. I did not came up
> with any solution, but i've noticed that 2 of my users (with this
> problem)are behind the same proxy. Do you see some sance in this theory.
>
> .n

---

quote:

---

> Not 100% but I seem to recall a plugin problem similar to that. I'd suggest
> getting the latest level of the plugin installed. Another thing to consider
> trying is to disable esi caching to see if that helps (this setting is in
> config\cells\plugin-cfg.xml file).
>
> ".nippy" wrote:
>
>
>
>

---

quote:

---

> I have fixpack 2 installed (WAS 5.0.2) and the setting for ESI caching
> is disabled by default. So it must be something else ...
>
>
>

---

quote:

---

> I fixed the problem now. The session ID was created when the user first
> accessed any jsp on the server. For some reason, session ID creation is not
> synchronized by the server. So, I turned off sessions (<%@ page
> session="false" %> ) on all pages prior to logging in and synchronized the
> call to request.getSession(true).
>
> I don't know if this is the way IBM meant for us to do this or if it is a
> bug. What happens when you want session state but don't want the user to
> login?
>
> -JG
>
>

---

quote:

---

> you do, it's because the variable you're putting it in isn't threadsafe.

---