title: Global session + authentication, multiple contexts in Jetty
body: <p>I seem to be running into an odd problem with scoped handlers in Jetty 7. What I want to achieve is to have a single authentication page (and a single session), which protects multiple <code>WebAppContext</code>s. The sensible solution seemed to me to put all the webapps in a <code>ContextHandlerCollection</code>, and to wrap this in a <code>SecurityHandler</code> and <code>SessionHandler</code>. However, looking at the Jetty code, it seems to me that this can never work propery. The following code demonstrates the core problem:</p>
  
  <pre><code>Server server = new Server(8000);
  
  SimpleServlet h1 = new SimpleServlet("Servlet 1");
  SimpleServlet h2 = new SimpleServlet("Servlet 2");
  
  ServletContextHandler c1 = new ServletContextHandler();
  ServletContextHandler c2 = new ServletContextHandler();
  
  c1.addServlet(new ServletHolder(h1), "/");
  c2.addServlet(new ServletHolder(h2), "/");
  
  c1.setContextPath("/context1");
  c2.setContextPath("/context2");
  
  ContextHandlerCollection chc = new ContextHandlerCollection();
  chc.setHandlers(new Handler[]{c1, c2});
  
  SessionHandler sh = new SessionHandler();
  sh.setHandler(chc);
  
  server.setHandler(sh);
  </code></pre>
  
  <p>When a request comes in, this ends up in <code>handle</code> in the <code>SessionHandler</code>. Here, <code>doScope</code> is called, since the session handler is the outermost scope. The problem is that the <code>ContextHandlerCollection</code> is not a scoped handler, so <code>nextScope</code> is set to the first <code>ServletContextHandler</code>! There is no way that <code>doScope</code> will ever be called on the second <code>ServletContextHandler</code>. </p>
  
  <p>But, even that first servlet is not reachable. <code>doScope</code> in the <code>ServletHandler</code> is called, and ends up calling <code>doHandle</code> on the outer scope (the session handler) with <code>target</code> set to <code>/</code>. But: the <code>ContextHandlerCollection</code> does not know of a context called <code>/</code>, so the result is a 404.</p>
  
  <p>What am I missing here?</p>