WAS v8.5 > Reference > Custom properties

Session management custom properties

Session management properties, like the session management configuration, can be configured at the server, application, or web module level. The following steps are for setting the custom properties for session management at the server level.

1. In the dmgr console click...
   Servers | Server Types | WebSphere application servers | server_name | Session management | Additional Properties | Custom Properties | New

2. On the settings page, enter the property to configure in the Name field and the value to set it to in the Value field.

3. Click Apply or OK.

4. Click Save on the console task bar to save your configuration changes.

5. Restart the server.

We can use the custom properties page to define the following session management properties:

• AlwaysEncodeURL
• (v8501) checkSessionNewOnIsValidRequest
• CloneSeparator
• CloneSeparatorChange
• DebugSessionCrossover
• DelayAfterDuplicateIdException
• ForceSessionInvalidationMultiple
• HideSessionValues
• HttpSessionCloneId
• HttpSessionIdLength
• HttpSessionIdReuse
• HttpSessionReaperPollInterval
• InvalidateOnUnauthorizedSessionRequestException
• NoAdditionalSessionInfo
• OptimizeCacheIdIncrements
• SecurityUserIgnoreCase
• Servlet21SessionCompatibility
• SessionIdentifierMaxLength
• SessionRewriteIdentifier
• SessionTableName
• SessionTableSkipIndexCreation
• UseInvalidatedId
• UseOracleBLOB
• UseApplicationSessionsAndInvalidateAll
• UseCustomSchemaName

AlwaysEncodeURL

The Servlet 2.5 specification specifies to not encode the URL on a response.encodeURL call if it is not necessary. To support backward compatibility when URL encoding is enabled, set the AlwaysEncodeURL custom property to true to call the encodeURL method. The URL is always encoded, even if the browser supports cookies.

(v8501)

checkSessionNewOnIsValidRequest

Specify whether the server can handle multiple simultaneous client requests when HttpSessionIdReuse is enabled.

By default, the session manager handles one client request at a time when property HttpSessionIdReuse is also enabled. Set checkSessionNewOnIsValidRequest to false to allow the session manager to handle multiple simultaneous requests from a client when HttpSessionIdReuse is enabled. If HttpSessionIdReuse is not enabled, this property has no effect.

Restart the server for the configuration change to take effect.

The default value for this property is true.

CloneSeparator

Specify a different character as the clone separator in session cookies. The value specified for this custom property must be a single character.

This property was set as a web container custom property in v6.1 but must now be set as a session management custom property.

Best practice: This property should only be used as a means to provide more flexibility if we have a situation where we cannot use either a colon (:), or a plus sign (+) as the clone separator in session cookies. You should understand the clone character requirements of other products running on your system before using this property to change the clone separator character.

The fact that any character can be specified as the value for this custom property does not imply the character we specify will function correctly. This fact also does not imply that IBM is responsible for fixing any problem that might arise from using an alternative character. bprac

CloneSeparatorChange

Use this property to maintain session affinity. The clone ID of the server is appended to session identifier separated by colon. On some Wireless Application Protocol (WAP) devices, a colon is not allowed. Set to true to change clone separator to a plus sign (+).

DebugSessionCrossover

The DebugSessionCrossover custom property enables code to perform additional checks to verify that only the session associated with the request is accessed or referenced. Messages are logged if any discrepancies are detected.

Set to true to enable session data crossover detection.

See article, HTTP session problems, for additional information.

DelayAfterDuplicateIdException

The DelayAfterDuplicateIdException custom property is used to specify how long, in milliseconds, the session manager should wait before attempting to retrieve a session from the backend server after a SESN0196W error occurs.

The default value for this property is 500.

ForceSessionInvalidationMultiple

The ForceSessionInvalidationMultiple custom property indicates whether the session manager should wait indefinitely for a request to complete before attempting to invalidate the session, or should attempt to invalidate a session after the specified time limit has elapsed. The default value for this property is 3.

• If we specify 0 (zero) for this custom property, the session manager waits indefinitely until a request is complete before attempting to invalidate the session.

  If wer requests normally are not bound by a response time limit, specify 0 for this property.

• If we specify a positive integer, such as 1, 2, or 3, for this custom property, even if a session is not known to have completed, the session manager attempts to invalidate the session, if the indicated time period since the last access occurred has elapsed. This time period is the result of multiplying the value specified for this property and the value specified for the Session Timeout property. For example, if we specify 2 minutes for the Session Timeout property and 2 for the ForceSessionInvalidationMultiple property, the session manager attempts to invalidate the session after 4 minutes.

  To invalidate your sessions after a certain amount of time has elapsed, specify the appropriate positive integer for this property.

HideSessionValues

The HideSessionValues custom property prevents the logging of session attribute values in session manager traces.

Applications store these session attribute values. Default is true.

HttpSessionCloneId

Use this property to change the clone ID of the cluster member. Within a cluster, this ID must be unique to maintain session affinity. When set, this name overwrites the default name generated by WAS.

Default clone ID length: 8 or 9

HttpSessionIdLength

Use this property to configure the session identifier length. Do not use an extremely low value; using a low value results in reduced number of combinations possible, thereby increasing risk of guessing the session identifier. In a cluster, all cluster members should be configured with same ID length. Allowed range: 8 to 128. Default length: 23.

HttpSessionIdReuse

The custom property HttpSessionIdReuse determines whether the session manager can use the session ID sent from a browser to preserve session data across web applications that are running in an environment not configured for session persistence.

In a multi-JVM environment not configured for session persistence setting this property to true enables the session manager to use the same session information for all of a user's requests even if the web applications that are handling these requests are governed by different JVMs. The default value for this property is false. Set to true to enable the session manager to use the session ID sent from a browser to preserve session data across web applications that are running in an environment not configured for session persistence.

HttpSessionReaperPollInterval

Specify, in seconds, a wake-up interval for the process that removes invalid sessions. The value specified for this property overrides the default installation value, which is between 30 and 360 seconds, and ensures the reaper process runs at a specific interval.

If the maximum inactive interval is less than 2 minutes, the reaper poll interval may be as short as 30 seconds.

If the maximum inactive interval is more than 15 minutes, the reaper poll interval can be as long as 6 minutes.

Because the default timeout and maximum inactive interval is 30 minutes, the reaper interval is usually between 5 and 6 minutes.

For example, you might want to use this property if you want the installation timed out sessions invalidated more frequently than 5 to 6 minutes. Specifying HttpSessionReaperPollInterval=120 ensures that sessions are invalidated within 2 minutes of timing out.

Minimum value for this property is 30 seconds. If a value less than the minimum is entered, the specified property is ignored and an appropriate value is automatically determined and used. Maximum inactive interval is the session timeout. The default is based on maximum inactive interval set in session management.

InvalidateOnUnauthorizedSessionRequestException

Set to true if, in response to an unauthorized request, you want the session manager to invalidate a session instead of issuing an UnauthorizedSessionRequestException error message.

When a session is invalidated, the requester can create a new session, but does not have access to any of the previously saved session data. This invalidation allows a single user to continue processing requests after a logout while still protecting session data.

The default value for this property is false.

NoAdditionalSessionInfo

Set this property true to force removal of information not needed in session identifiers.

In WAS base edition, a clone ID of -1 is never used; therefore, a clone ID is not included in base edition when this is set. Also, cache ID is not used with nonpersistent sessions; so the cache ID is not included with nonpersistent sessions when this value is set.

OptimizeCacheIdIncrements

Set the OptimizeCacheIdIncrements custom property to true to make the session manager assess whether the in-memory session for a web module is older than the copy in persistent store. Setting this property resolves the continually increasing cache ID.

If HTTP session management is configured to use session persistence and the user's browser session is moving back and forth across multiple web applications you might see extra persistent store activity as the in-memory sessions for a web module are refreshed from the persistent store. As a result, the cache IDs are continually increasing and the in-memory session attributes are overwritten by those of the persistent copy. Set to true to prevent the cache IDs from continually increasing.

If the configuration is a cluster, ensure the system times of each cluster member is identical as possible.

SecurityUserIgnoreCase

Set to true if you want the session security identity and the client security identity to be considered a match even if their cases are different.

When a user configures session security integration, the session manager compares the security identity of th session owner with the security identity of the client request. Because the matching criteria is case sensitive, if these two identities do not exactly match, an UnauthorizedSessionRequestException is sent back to the client.

If we have situations where you want the session security identity and the client security identity to be considered a match even if their cases are different, add the SecurityUserIgnoreCase custom property to your Web container configuration settings, and set the property to true. When true, an UnauthorizedSessionRequestException does not occur if the session security identity and the client security identity are identical except for their cases. For example, when this property is set to true, the session security identity USER1 matches the client security identities User1 and user1.

Servlet21SessionCompatibility

Set true to enable global session behavior. In Servlet 2.2 and later, sessions are scoped at the Web module level. The default is false.

Deprecated feature: This property is deprecated. The IBMApplicationSession method replaces the function of the Servlet21SessionCompatibility custom property.

SessionIdentifierMaxLength

Maximum length that a session identifier can grow.

This property helps to find out the condition and take appropriate action to address servers fail-over. When this is specified, message is logged when specified maximum length is reached. Allowed value: integer.

SessionRewriteIdentifier

Use this property to change the key used with URL rewriting. The default key is jsessionid.

SessionTableName

Set the database table name. Allowed value: String. Default is SESSIONS.

Some applications may rely on method ejbCreate(...) to have created the entity bean in the database. For such a requirement, setting the JVM property com.ibm.websphere.ejbcontainer.allowEarlyInsert to true overrides the default behavior.

SessionTableSkipIndexCreation

Disable index creation on server startup.

This custom property should only be used to manually create our own database indices for session persistence. However, IBM recommends that you let session manager create database indices.

To enable this property, go to the session management custom properties dmgr console page, enter the SessionTableSkipIndexCreation property name and set its value to true. Before enabling this property, verify the correct index does exist on your session database.

UseInvalidatedId

Set true to reuse the incoming ID if the session with that ID was recently invalidated. This is a performance optimization because it prevents checking the persistent store. Default is true.

UseOracleBLOB

The UseOracleBLOB custom property creates the HTTP session database table using the Binary Large Object (BLOB) data type for the medium column. This property increases performance of persistent sessions when Oracle databases are used. Due to an Oracle restriction, BLOB support requires use of the Oracle Call Interface (OCI) database driver for more than 4000 bytes of data. You must also ensure that a new sessions table is created before the server is restarted by dropping your old sessions table or by changing the datasource definition to reference a database that does not contain a sessions table.

To create a sessions table using the BLOB data type, use the following name-value pair:

Name	Value
UseOracleBLOB	true

UseApplicationSessionsAndInvalidateAll

When the invalidateAllSet method is called, not all IBMApplicationSessions objects are checked. If we are using both the IBMApplicationSessions object and the invalidateAll call, use the following name-value pair:

Name	Value
UseApplicationSessionsAndInvalidateAll	true

UseCustomSchemaName

Use this property to ensure the session manager successfully detects the sessions table on subsequent server startups.

Set true if you are using DB2 for sessions persistence and the customSchema property is not set to the default value in the DB2 JDBC driver.

Default is false.

Related

Configure session management by level
Configure a unique HTTP session clone ID for each application server using scripting

+

Search Tips   |   Advanced Search