title: DefaultWebSessionManager not works on Chrome
body: <p>Well, I have posted following question on Shiro's forum for 1 week but no response until now.</p>
  
  <p>I am just trying to use Shiro with a simple Spring application. The security manager is defined as <code>DefaultWebSecurityManager</code> which set session manager as <code>ServletContainerSessionManager</code> by default and it works for me. However, after I changed the session manager to <code>DefaultWebSessionManager</code> which means I want to use Shiro's native session, it not works on Chrome. I dug out some following information:- </p>
  
  <ul>
  <li>When using <code>DefaultWebSessionManager</code>, Shiro tries to get session id from request cookie. The logic <code>SimpleCookie</code> is looping all request cookies and return when a cookie's name is 'JSESSIONID'. However, in the requests come from Chrome, there are 2 cookies with name 'JSESSIONID'. The value of the first one is different with 'requestedSessionid' in request and the other one equals. That result in a new redirect to login page after authentication successfully. To make it simple, the process now is: access any address -> redirect to login page by Shiro -> submit principals and credentials -> authentication successfully and redirect to home page by Shiro -> a new request comes and found another session id which is not cached in Shiro, result in a <code>InvalidSessionException</code> in <code>resolveSession</code> method in <code>DefaultSecurityManager</code> -> redirect back to login 
  page. </li>
  <li>When using <code>ServletContainerSessionManager</code>, since the session id is come from request.getSession(false), the session could be found after redirect. </li>
  </ul>
  
  <p>My question is if this is a defect or anything configurations or codes can fix this problem? Note only Chrome fires this problem. I guess it's about Chrome's cache but can you explain more? </p>
  
  <p>Below is the necessary sources for you to replicate:- </p>
  
  <p>web.xml </p>
  
  <pre><code>&lt;listener&gt;
    &lt;listener-class&gt;test.shiro.framework.WebSessionListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  &lt;listener&gt;
    &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  &lt;context-param&gt;
    &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
    &lt;param-value&gt;/WEB-INF/spring-servlet.xml&lt;/param-value&gt;
  &lt;/context-param&gt;  
  
  
  &lt;filter&gt;
    &lt;filter-name&gt;shiroFilter&lt;/filter-name&gt;
    &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
    &lt;init-param&gt;
      &lt;param-name&gt;targetFilterLifecycle&lt;/param-name&gt;
      &lt;param-value&gt;true&lt;/param-value&gt;
    &lt;/init-param&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
    &lt;filter-name&gt;shiroFilter&lt;/filter-name&gt;
    &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;servlet&gt;
    &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/controller/*&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  </code></pre>
  
  <p>spring-servlet.xml: </p>
  
  <pre><code>&lt;bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"&gt;
    &lt;property name="securityManager" ref="securityManager" /&gt;
    &lt;property name="loginUrl" value="/login.jsp"/&gt;
    &lt;property name="successUrl" value="/home.jsp"/&gt;  
    &lt;property name="unauthorizedUrl" value="/unauthorized.jsp"/&gt;
  
    &lt;property name="filterChainDefinitions"&gt;
      &lt;value&gt;
        /** = authc 
      &lt;/value&gt;
    &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"&gt;
  
    &lt;property name="realm" ref="myRealm" /&gt;
    &lt;property name="sessionManager"&gt;
      &lt;bean class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager"&gt;&lt;/bean&gt;
    &lt;/property&gt;
  
  &lt;/bean&gt;
  &lt;bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" /&gt;
  
  &lt;bean id="myRealm" class="org.apache.shiro.realm.text.TextConfigurationRealm"&gt;
    &lt;property name="userDefinitions"&gt;
      &lt;value&gt;
        huzj=12345678,authc 
        guodg=12345678,operator 
        sadd=12345678,guest 
      &lt;/value&gt;
    &lt;/property&gt;
    &lt;property name="roleDefinitions"&gt;
      &lt;value&gt;
        authc=* 
        operator=book:* 
        guest=book:view:* 
      &lt;/value&gt;
    &lt;/property&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>Feb 18 UPDATE:
  A further testing shows that the problem only occured when I tried to change from <code>ServletContainerSessionManager</code> to <code>DefaultWebSessionManager</code>. I guess chrome records a junk cookie in this situation by mistake.</p>
  
  <p>After all I tried @paulochf's solution and it does work. I debugged again and believe you got the point. Many thanks!</p>