Hi All,

We currently have a portal deployed to weblogic 10.3 and also installed our custom portlets and custom theme plugins into it. In the custom theme we have several CSS and JS referred in the velocity template.

The session creation in the portal seems to be out of control as I can see about 300 sessions in the weblogic admin console for our custom theme application although I am the only user. I would have thought all the sessions are only created in the liferay portal application, not in the plugin. The theme itself doesn't have any code other than CSS, JS, images and velocity template, so I suspect those sessions are created by liferay servlet filters.

Further debugging also shows that new session IDs created for the theme plugin are sent back to the client browser and that overrides the client original session ID that was used logged in to the portal. So any click on the portal will redirect the user to the login page.

I am quite tempted to modify the weblogic.xml to add the <sharing-enabled>true</sharing-enabled> to share the session between apps. But I am not sure if that's the way to go as now I am forced to modify liferay WAR file.

Any suggestions are greatly appreciated.

Are you using a weblogic cluster? If so, how are you front ending the cluster? Apache+mod_weblogic?

Also, where in the console are you seeing all the sessions?

Hi Amit,

In our UAT, we have clustered env setup with F5 and IBM TAM. I realize the request to the portal and to the theme may not be sticky as they are two seperate junctions setup in TAM. But the main cause of the problem is getting a CSS or Javascript file from the theme is causing the browser getting a new jsessionID. I am quite sure that some liferay filters are generating a new session ID when I ask for a CSS or JS. Any idea which filters it might be?

I also have a local dev environment without any cluster and running it straight to the server host.
Although running locally doesn't have the wrong session ID issue but I still have hundred of sessions.

I got the session numbers from Deployment->Monitoring inside the console.

Context Active Server Count Current Sessions
/portal-theme-macq 2 76
/researchportal 2 55
/portlets-access-pass 2 138

It's hard to say. You might be seeing lots of sessions because you don't have stickysession enabled, and each request for a different image is generating a different JSESSION id.

But from my experience, you definitely need to have stickysession enabled (via whatever mechanism).

Is TAM front ending all the traffic to the weblogic cluster? If so, you will also need to enable sticysession there if you are front-ending multiple WLS managed servers. Btw, why aren't you using Websphere?

Hi Amit,

We currently have two junctions setup, one for liferay portal and another for the theme. The TAM junction is set to have sticky session but that is only per junction.

So a client may hit different server when asking for static contents from the theme junction, which originally we thought was fine because it's static contents.

I can move the theme into the same junction as the portal, but then I will have to explicitly put the portal junction in the HTML and velocity templates. I guess I will try turning off each filter that filters the *.js and *.css and check which filter issues the jsessionid.

Not using Websphere is because our company has a team that hosts a farm of WL managed servers. So it's a cheaper option for us to use whatever exists. Thanks Amit.

I found out the filters that create the new session are:
- CacheFilter
- LanguageFilter

When it makes call to LanguageUtil.getLanguageId(request); that eventually try to get the locale from HTTPSession object. Our project doesn't use any other language for now, so I overrode the CacheFilter to just get the default locale. Problem solved