Change cookie for subdomain - conflict with main application

[8年前 に Patrick Neil によって更新されました。]

Hello,

I´d like to ask you for a help. In our company, we run a main Liferay app at www.domain.com. Besides this portal, we have also a small application running on separate Liferay instance at secondapp.domain.com.

The problem is cookies conflict. Once I visit www.domain.com, I get JSESSIONID cookie for domain ".domain.com". Then, When I go to the second app, and I login, I get another JSESSIONID for domain ".secondapp.domain.com".

Those 2 cookies are in conflict. Is there any way how to set the second Liferay (secondapp) to use JSESSIONID under other name, like APP2SESSIONID? I know I can change the name of the cookie in jboss config, but where can I change it for Liferay? Is it going to work with custom named JSESSIONID?

Thanks for a reply!
PN

[8年前 に David H Nebinger によって更新されました。]

I think the cookie is a wildcard cookie because you are logged into the portal as a whole and can navigate to whatever sites you host on the portal even when the subdomain (vhosts) changes.

[8年前 に Patrick Neil によって更新されました。]

I quite didn´t get your idea. Can you explain more please?
My problem is 2 application on the same root domain using JSESSIONID cookie which are in conflict. Is it ok for Liferay to rename the cookie of the second application to something else (SECONDSESSIONID). Where to do it in Liferay?

Thanks!
Honza

[6年前 に Srijit Saini によって更新されました。]

Hi Patrick,
I am also facing the same issue, did you find any solution for this?

[6年前 に Olaf Kock によって更新されました。]

Liferay has nothing to do with JSESSIONID. This is purely set by Tomcat. If you configure your Tomcat to set the cookie on the whole domain: it will. If you specify a particular domain: That's what Tomcat will take.

AFAIK tomcat defaults to set the session cookie to the exact domain you're coming from, not to the wildcard. Check your server.xml, maybe you or someone else configured this already and you just forgot about it.

[6年前 に Srijit Saini によって更新されました。]

It was not just about JSESSIONID cookie but others also like the LOGIN, PASSWORD etc. But yes found a property that has to be set in portal-ext.properties.
Set this to true to use the full hostname for cookie domain values. By default the domain is trimmed to use only the root domain to allow cross domain logins.
session.cookie.use.full.hostname=true

[6年前 に Olaf Kock によって更新されました。]

oops - seems I've learned something. Thanks for reporting back.