title: Glassfish create more than one http session in realm authentication
body: <p>I have a question about realm authentication, where glassfish create more than one http session. Here's an example</p>
  
  <p>Web.xml:</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
        &lt;web-resource-name&gt;AllPages&lt;/web-resource-name&gt;
        &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
        &lt;role-name&gt;user&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
    &lt;/security-constraint&gt;
    &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
      &lt;realm-name&gt;FileRealm&lt;/realm-name&gt;
    &lt;/login-config&gt;
  &lt;security-constraint&gt;
  </code></pre>
  
  <p>glassfish-web.xml:</p>
  
  <pre><code>  &lt;security-role-mapping&gt;
      &lt;role-name&gt;user&lt;/role-name&gt;
      &lt;group-name&gt;users&lt;/group-name&gt;
    &lt;/security-role-mapping&gt;
  </code></pre>
  
  <p>login.jsp:</p>
  
  <pre><code>&lt;html&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;
  &lt;title&gt;Welcome Page&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;p&gt;You have successfully logged into the application.&lt;/p&gt;
  &lt;a href="./home.jsp"&gt;go to home&lt;/a&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>SessionListener:</p>
  
  <blockquote>
    <p>@WebListener public class SessionListener implements
    HttpSessionListener {</p>
    
    <p>public void sessionCreated(HttpSessionEvent arg0) {</p>
    
    <p>System.out.println("Session created id:"+arg0.getSession().getId());<br>
    }</p>
    
    <p>public void sessionDestroyed(HttpSessionEvent arg0) {</p>
  
  <pre><code>  System.out.println("Session destroyed id:"+arg0.getSession().getId());
  </code></pre>
    
    <p>}</p>
    
    <p>}</p>
  </blockquote>
  
  <p>When I authenticate, glassfish create a new session:</p>
  
  <p>INFO: Session created id:29c5d904db0e40b9cfbdac40aa5e</p>
  
  <p>And when I click on "go to home" link or refresh the page, glassfish create another http session:</p>
  
  <p>INFO: Session created id:2a67270137e38c150bf3690e2e46</p>
  
  <p>And I also noticed that glassfish never destroy the first created session.</p>
  
  <p>Thank's for your help</p>