java - 如何在重定向中删除 session ID Apache2 AJP 负载平衡 Tomcats

Question

好的，首先我们有一个在 Tomcat 节点上运行的 java servlet 应用程序。在此之前，我们有 Apache2 使用 ajp 连接器进行负载平衡。

通常，我们会滚动更新错误修复。这需要使用 Apache Jk Status Manager 禁用节点并将所有新流量重定向到 Activity 节点。这允许用户保留在旧节点上直到注销。经过漫长的等待后，我通常可以停止禁用的节点并将更新移入。然后激活该节点并禁用其他节点。

我想要解决的问题是防止非 Activity 用户在 session 结束后重新连接到禁用的节点。文档中提到了这个问题。

A final note about setting activation to disabled: The session id coming with a request is send either as part of the request URL (;jsessionid=...) or via a cookie. When using bookmarks or browsers that are running since a long time, it is possible to send a request carrying an old and invalid session id pointing at a disabled member. Since the load balancer does not have a list of valid sessions, it will forward the request to the disabled member. Thus draining takes longer than expected. To handle such cases, you can add a Servlet filter to your web application, which checks the request attribute JK_LB_ACTIVATION. This attribute contains one of the strings "ACT", "DIS" or "STP". If you detect "DIS" and the session for the request is no longer active, delete the session cookie and redirect using a self-referential URL. The redirected request will then no longer carry session information and thus the load balancer will not send it to the disabled worker. The request attribute JK_LB_ACTIVATION has been added in version 1.2.32.

我的问题是针对粗体声明的。如何防止在重定向中发送 JSESSION ID。

我现在使用的代码最终陷入无限重定向循环。

       public final void doGet(HttpServletRequest req, HttpServletResponse res)
                    throws IOException, ServletException
            {
        ...
            String status = (String)req.getAttribute("JK_LB_ACTIVATION");
                         log.info("Node status " + status);
                         if("DIS".equals(status)) {
                            log.info("Status disabled, looking for session ");
                            Collection<HttpSession> col = TurbineSession.getActiveSessions();
                            Iterator<HttpSession> it = col.iterator();
                            boolean found = false;
                            String requestSession = req.getRequestedSessionId();
                            sessionSearch: while(it.hasNext()) {
                                HttpSession session = (HttpSession) it.next();
                                log.info("Comparing " + requestSession + " to " + session.getId());
                                if(session.getId().equals(requestSession)) {
                                    found = true;
                                    break sessionSearch;
                                }
                            }
                            if(!found) {
                                String path = "mypath";
                    Cookie[] cookies = req.getCookies();
                    for(Cookie tempCookie : cookies) {
                        if(requestSession.equals(tempCookie.getValue())) {
//                          tempCookie.setValue(null);
                            tempCookie.setMaxAge(0);
//                          tempCookie.setPath(path);
                            res.addCookie(tempCookie);
                        }
                    }
                    res.sendRedirect(path);
                    return;
                            }
                         }
    ...
    }

使用 Firebug 检查重定向显示 JSESSIONID 仍然包含在重定向中。我该如何删除它？我所看到的有关删除 cookie 的所有内容似乎都不起作用。

Answer 1

How do you remove a Cookie in a Java Servlet

添加

tempCookie.setPath("/");

而不是使用完整路径或将其省略，最终做到了(似乎做到了)这个技巧。我确信有一些深奥的解释。