Weblogic jsessionid

Question

I run Weblogic 10.3 locally and ask a question about the sessionId that it generates. When I type session.getId (), I see something similar to this:

BBp9TAACMTglQ2TDFAKR4tpyXg73LZDQJ2PtT9x8htG1tWY122aa! 869187422! 1308677666322

what are these exclamation marks and what follows, in particular the second pair :! 1308677666322? It seems that sometimes the server adds it, and sometimes not. I believe that weblogic adds it if I use the same browser to log into my application a second time. Is this cookie somehow?

Answer 1

A look at some randomly generated JSession Weblogic ids from my own application

BrYx4hyPZ4VSP9Wo4eU0OrqmhXMLFONbRHnpLFwRKZ9MSaf6wvYj!-314662473 

and

 BrYiFED29itaC4EBpWYM8RKVQQauHkvnTsA2OAKUPZXVc9oUD5fB!-784323496. 

Now, if you notice a portion of the session id after the first! 314662473 and 784323496 .

This number is the unique identifier that Weblogic provides to the running JVM, that is, the running Weblogic server.

If there are multiple servers in the application, Weblogic knows how to redirect your session to the correct server using this 9-digit JVM number, which is part of the session ID.

Each time you restart the weblogic server, it will generate a new JVM ID and use it as long as this web server is running. Thus, any calls to this server will have the same identifier at the end of the session identifier.

Session ID Format :

JSESSIONID = SESSION_ID! PRIMARY_JVMID_HASH! SECONDARY_JVM_HASH! CREATION_TIME

So, if the primary file is not available, it will try to switch to the secondary one, and if you enable session replication, then the session data can be restored. If you use only one server on the local computer, then the format is simple

JSESSIONID = SESSION_ID! PRIMARY_JVMID_HASH! CREATION_TIME

in some cases it does not appear, I saw that usually the browser depends on whether sessionid is displayed in the address bar or not

Answer 2

WebLogic Server uses these identifiers to support the affinity of HTTP sessions in the memory replication model within the WebLogic cluster.

For those web applications that have HTTP session replication enabled (in the deployment descriptor weblogic.xml and disabled by default), WebLogic will store the main and backup copies of your HTTP session with the cluster.

To avoid cluster overhead, the WebLogic Proxy plug-in (deployed at your web tier) analyzes the session cookie and redirects each request to the WLS where your master copy is hosted. In the event of a failure or overhead of the managed server hosting the main session, the Proxy plugin redirects the request to the instance where your HTTP session is located.

The Proxy plugin will track a dynamic list of all members of the WebLogic cluster in pairs (JVM IDs / IP: ports) to redirect each request accordingly.

If your application does not activate the replication function in memory, your cookie will only include the JVM ID in which your HTTP-Sesion lives (primary and unique copy).