title: cookies with <path>/</path> and JSESSIONID
body: <p>I am experimenting with setting the cookie path in my application's web.xml (as suggested <a href="https://stackoverflow.com/a/9441231/274677">here</a>) to:</p>
  
  <pre><code>&lt;session-config&gt;
      &lt;cookie-config&gt;
          &lt;path&gt;/&lt;/path&gt;
      &lt;/cookie-config&gt;
  &lt;/session-config&gt;
  </code></pre>
  
  <p>So I deploy two identical web applications to <code>localhost:8080/application-a</code> and <code>localhost:8080/application-b</code> respectively.</p>
  
  <p>Each application is a single servlet:</p>
  
  <pre><code>public class ControllerServlet extends HttpServlet{
    @Override
    public void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
        HttpSession session = req.getSession(false);
  
        if (session == null) {
            session = req.getSession(true);
            System.out.printf("No session was present - new one created with JSESSIONID=[%s]\n", session.getId());
        } else {
            System.out.printf("JSESSIONID cookie was present and HttpSession objects exists with JSESSIONID=[%s]\n", session.getId());
        }
    }
  }
  </code></pre>
  
  <p>I deploy the apps to a Tomcat 8.5 container (tried with Tomcat 9 as well the behavior is the same). When I visit with my browser the <code>application-a</code>, here's what I see:</p>
  
  <p><a href="https://i.stack.imgur.com/v4XN5.png" rel="noreferrer"><img src="https://i.stack.imgur.com/v4XN5.png" alt="enter image description here"></a></p>
  
  <p>&hellip; and on the Tomcat logs I read:</p>
  
  <pre><code>No session was present - new one created with JSESSIONID=[A227B147A4027B7C37D31A4A62104DA9]
  </code></pre>
  
  <p>So far so good. When I then visit <code>application-b</code> here's what I see:</p>
  
  <p><a href="https://i.stack.imgur.com/HuEj4.png" rel="noreferrer"><img src="https://i.stack.imgur.com/HuEj4.png" alt="enter image description here"></a></p>
  
  <p>&hellip; and the Tomcat logs show:</p>
  
  <pre><code>No session was present - new one created with JSESSIONID=[5DC8554459233F726628875E22D57AD5]
  </code></pre>
  
  <p>This is also very well as explained <a href="https://stackoverflow.com/q/19571325">here</a> and also <a href="https://stackoverflow.com/a/598923">in this answer</a> and I quote:</p>
  
  <blockquote>
    <p>SRV.7.3 Session Scope</p>
    
    <p>HttpSession objects must be scoped at the application (or servlet
    context) level. The underlying mechanism, such as the cookie used to
    establish the session, can be the same for different contexts, but the
    object referenced, including the attributes in that object, must never
    be shared between contexts by the container.</p>
  </blockquote>
  
  <p>So even though on the request the <code>JSESSIONID</code> cookie was present, my application (the one deployed in <code>application-b</code>) was unable to find an HttpSession object <b>in its own servlet context scope</b> and so a new session object was created and a new value was assigned to the <code>JSESSIONID</code> cookie.</p>
  
  <p>However, when I now go back to my <code>application-a</code> I find out that because of the <code>/</code> value configured for the cookie path, it is now trying to use the <code>JSESSIONID</code> value set by <code>application-b</code> and of course its servlet doesn't find such a session object in its own context (<code>application-a</code>) and so a new value for the <code>JSESSIONID</code> cookie is created which will in turn invalidate the session of the <code>application-b</code> application and so on and so forth ad infinitum as I switch back and forth between the two applications.</p>
  
  <p>So my questions are:</p>
  
  <p><a href="https://stackoverflow.com/a/9441231/274677">1</a> given the above behavior it would seem impossible for two applications to use the same <code>JSESSIONID</code> cookie value as the key to their respective HttpSession objects. So in fact not only are the HttpSession objects always different and scoped at the application (servlet context) level but also, in practice, the <code>JSESSIONID</code> values have to be different. Is that correct?</p>
  
  <p><a href="https://i.stack.imgur.com/v4XN5.png" rel="noreferrer">2</a> If so, then why does the servlet specification use the wording:</p>
  
  <blockquote>
    <p>The underlying mechanism, such as the cookie used to establish the
    session, can be the same for different contexts [...]</p>
  </blockquote>
  
  <p>The only way I can imagine the above could be accomplished would be to have a way to hardcodedly provide the <code>JSESSIONID</code> value to use when a new session object is created? But I don't see an API for that.</p>
  
  <p><a href="https://i.stack.imgur.com/HuEj4.png" rel="noreferrer">3</a> Is there a way I can have some other cookies be shared among applications using the <code>/</code> path in the &lt;session-config&gt; XML element but not have the <code>/</code> path apply to the <code>JSESSIONID</code> cookie? In other words does the &lt;session-config&gt; apply to all cookies of an application or only the cookie used for session tracking? (<code>JSESSIONID</code>) ?</p>