Moqui session becomes unauthenticated after page refresh on one production server

Technical Questions
1

Hi,

I’m experiencing a strange session/authentication issue with Moqui in production and would appreciate any suggestions on where I should investigate.

I have the same Moqui application/project deployed on multiple production servers. The application works correctly on other servers, but on one specific server the logged-in session is lost after refreshing a page.

The issue happens as follows:

  1. User opens the login page.
  2. User logs in successfully.
  3. Moqui returns a 302 response and sets a new JSESSIONID:
HTTP/1.1 302
Set-Cookie: JSESSIONID=9F36E0EB5F97122B94130ADBCB79B3A4; Path=/; Secure; HttpOnly
  1. The browser then requests the target page using exactly that JSESSIONID:
GET /apps/my/User/Task/Tasklist/myTasks

Cookie:
JSESSIONID=9F36E0EB5F97122B94130ADBCB79B3A4

The response is:

HTTP/1.1 200

So at this point the session and authentication are working correctly.

  1. However, after refreshing the same page, the browser sends a different JSESSIONID:
Cookie:
JSESSIONID=F8177EE11CD5904381A506D7E9C6CD1F

and Moqui responds with:

HTTP/1.1 302
Location: /Login

There is no Set-Cookie in this response.

Important observations

  • There is only one JSESSIONID cookie in the browser; there are no duplicate JSESSIONID cookies with different paths/domains.
  • cookiesession1 also exists, but it exists on the working server as well, so it does not appear to be the differentiating factor.
  • The first request after login works successfully with the newly assigned JSESSIONID.
  • The problem occurs only after refreshing the page.
  • The same application works correctly on other production servers.
  • The problematic server is running Tomcat directly; there is no Apache reverse proxy involved on this server.
  • The login itself succeeds, and the first authenticated request returns 200.
  • The failure happens later when the session is apparently no longer associated with the authenticated user.

For comparison, on the working production server, the post-login requests eventually reach the target page successfully, and refreshing the page keeps the user authenticated.

My main question

What could cause a Moqui/Tomcat session to behave like this?

Specifically, how could a session go from:

JSESSIONID = 9F36...
       ↓
authenticated and working (HTTP 200)
       ↓
refresh
       ↓
JSESSIONID = F817...
       ↓
unauthenticated → /Login

on only one server, while the exact same Moqui application works correctly on other servers?

Are there any Moqui or Tomcat configurations I should specifically compare, such as:

  • Tomcat session manager configuration
  • <Manager> configuration
  • session persistence
  • jvmRoute
  • Tomcat server.xml
  • <Host> / <Context> configuration
  • session timeout configuration
  • Tomcat version / Java version
  • cookie configuration
  • Moqui session/security configuration
  • multiple Tomcat JVMs or instances
  • anything that could cause a session to be invalidated or replaced between requests

I would especially appreciate suggestions for how to determine why the original authenticated session (9F36...) is being replaced/lost before the refresh, since the first request using that session works correctly.

Thanks!

2

As far as I know the session is by default invalidated after one hour of inactivity. Maybe there are some other settings that invalidate the session on that specific server. Some debugging on the server side might help to see what happens during the request after refresh. I dont remember the class exactly but there is some entry point for server side session validation. Maybe start from ShiroSecurityRealm. Also check the /runtime/sessions folder to see if your session is persisted there.

1 Like
3

what is the cause of this problem and why there is no problem in my other servers with same app?
the only diffrence is domain config in sever.xml file. is there a way that sometthing happen to request in server before it reach to tomcat???