title: Do applications with spring security share SecurityContextHolder among them
body: <p>I have two different applications, say <code>A</code> and . Both are using Spring Security with the same configuration. Here is my situation:</p>
  
  <p>I log into my <code>A</code> application. Everything works fine. But when I log into my <code>B</code> application (it has the same IP but different PORT) in another tab in the same browser, I see these lines (below) and I am thrown away from <code>A</code> application, which means I am no longer authenticated in it.</p>
  
  <blockquote>
    <p>DEBUG 2013-05-20 13:42:43,969 [http-8080-2] org.springframework.security.web.FilterChainProxy$VirtualFilterChain : /webapp/backoffice/index.jsp at position 2 of 12 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'</p>
    
    <p>DEBUG 2013-05-20 13:42:43,969 [http-8080-2] org.springframework.security.web.context.HttpSessionSecurityContextRepository : No HttpSession currently exists</p>
    
    <p>DEBUG 2013-05-20 13:42:43,969 [http-8080-2] org.springframework.security.web.context.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.</p>
  </blockquote>
  
  <ol>
  <li>I am using <code>HttpSessionSecurityContextRepository</code> as <strong>SecurityContextRepository</strong>.</li>
  <li>I have enabled <strong>SessionMigration</strong> for security purposes.</li>
  <li>I am using <strong>ConcurrentSessionFilter</strong>, to prevent someone being logged in via two or more devices.</li>
  </ol>
  
  <p>But I am not getting why logging in my <code>B</code> application, removes the HttpSession from <code>A</code> application? (Or maybe some other things are happening)</p>
  
  <p>I want to know whether these applications, share something in common within the browser.
  <hr>
  As I am asked about their IP/PORT, you should know that their IPs are the same (both localhost) but they have different ports.<br>
  <code>A)</code> <em>localhost:8080/dtts/backoffice</em><br>
  <code>B)</code> <em>localhost:8081/dtts/backoffice</em>
  <hr>
  <strong>SOLVED</strong><br>
  The problem was that for every <code>URL/Path</code> there will be a unique <code>JSESSIONID</code>. Both of my applications use <code>URL:localhost</code> and <code>Path:dtts</code>. That's why the second <code>JSESSIONID</code> replaces the first one.</p>