Websphere 6.1: How to add version to cookies?

StackOverflow https://stackoverflow.com/questions/5377142

Question

By default WebSphere 6.1 does not include version into LtpaToken and JSESSIONID cookies. Is there any way to enforce cookie version 1 for these cookies?

Does WebSphere 7.0 have this option?

-- EDIT --

Here is an example: When I log into some web application deployed on WebSphere, the session is created at some point. Then its ID is sent to the client browser (here is some output from FireBug):

GET /myApp/somepage.jsf HTTP/1.1
Host: 127.0.0.1:9080
...
Referer: http://127.0.0.1:9080/myApp/somepage.jsf
Cookie: someMyCookie=whatever;LtpaToken=9eC8Nk3Pu; JSESSIONID=00005YXN:-1;

I cut the cookies, since their content is irrelevant. But I'd like to see:

GET /myApp/somepage.jsf HTTP/1.1
Host: 127.0.0.1:9080
...
Referer: http://127.0.0.1:9080/myApp/somepage.jsf
Cookie: someMyCookie=whatever;LtpaToken="9eC8Nk3Pu";Version=1; JSESSIONID="00005YXN:-1";Version=1;

I may control my cookies (someMyCookie) and set them version. However I can't control JSESSIONID and LtpaToken. Is there any way to set them to version 1?

Regards

Was it helpful?

Solution

Your requirements are not sane.

JSESSIONID does not have version incompatibilities or different versions, it is just locally known (or shared with cell) ID number. LTPAKEY is always version 1. LTPAKEY2 named cookie contains always version 2. Probably when there will be version 3 the new cookie will be named LTPAKEY3.

OTHER TIPS

Are you trying to do SSO accross older servers? You might want to try the Interoperability mode setting in the admin console: Global security > Single sign-on (SSO)

Interoperability mode

Specifies that an interoperable cookie is sent to the browser to support back-level servers.

In WebSphere® Application Server, Version 6 and later, a new cookie format is needed by the security attribute propagation functionality. When the interoperability mode flag is enabled, the server can send a maximum of two single sign-on (SSO) cookies back to the browser. In some cases, the server just sends the interoperable SSO cookie.
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top