PK84099: COOKIES IMPROPERLY PERSISTING ACROSS CLIENT INSTANCES

Java SDK 1.5 SR10 Cumulative Fix for WebSphere Application Server
6.1.0.29: Java SDK 1.5 SR11 Cumulative Fix for WebSphere Application Server
6.1.0.31: Java SDK 1.5 SR11 FP1 Cumulative Fix for WebSphere Application Server
6.1.0.33: Java SDK 1.5 SR12 FP1 Cumulative Fix for WebSphere
6.1.0.35: Java SDK 1.5 SR12 FP2 Cumulative Fix for WebSphere
6.1.0.37: Java SDK 1.5 SR12 FP3 Cumulative Fix for WebSphere
6.1.0.47: WebSphere Application Server V6.1 Fix Pack 47
6.1.0.39: Java SDK 1.5 SR12 FP4 Cumulative Fix for WebSphere Application Server
6.1.0.41: Java SDK 1.5 SR12 FP5 Cumulative Fix for WebSphere Application Server
6.1.0.43: Java SDK 1.5 SR13 Cumulative Fix for WebSphere Application Server
6.1.0.45: Java SDK 1.5 SR14 Cumulative Fix for WebSphere Application Server
6.1.0.47: Java SDK 1.5 SR16 Cumulative Fix for WebSphere Application Server

APAR status

• Closed as program error.

Error description

• If a customer uses multiple BindingProvider instances
  (dispatch objects or proxy objects) to interact with the same
  web service, the session management cookies may be corrupted.
  
  The customer may experience difficult to diagnose cookie
  errors or other session management problems.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server Feature    *
  *                  Pack for Web Services client applications   *
  *                  that use JAX-WS and maintain sessions       *
  ****************************************************************
  * PROBLEM DESCRIPTION: The session cookies for multiple        *
  *                      BindingProviders are corrupted.         *
  ****************************************************************
  * RECOMMENDATION:  Install a fixpack containing this APAR on   *
  *                  the WebSphere Application Server of the web *
  *                  service client application                  *
  ****************************************************************
  When a JAX-WS client application enables session management,
  the JAX-WS runtime manages the cookies for the session.
  
  The JAX-WS client application interacts with the remote web
  service using a JAX-WS BindingProvider.  The BindingProvider
  may be a JAX-WS Dispatch object or a JAX-WS proxy.
  
  If the JAX-WS client application creates multiple
  BindingProviders for the same web service, the cookies for the
  different sessions may become intermingled.  This can cause
  corruption of the cookies or other session management
  related errors.
  

Problem conclusion

• The root of this problem is that the cookie information is
  globally scoped to the web service instead of specifically
  scoped to the BindingProvider.  This problem causes the
  cookies to be shared across all of the BindingProvider
  objects.
  
  The JAX-WS runtime is changed to scope the cookie information
  to its BindingProvider.  Thus each BindingProvider will have
  distinct cookies and a unique session.
  
  The IBM development team cannot envision any reason why a
  customer would want the prior behavior (shared cookies across
  BindingProvider objects).  But if a customer needs the old
  behavior, he or she can set the new system property:
  
  com.ibm.ws.websvcs.jaxws.cookie.info.scoped.to.service.context=t
  rue
  
  
  This problem is already fixed in v7 by APARS PK78312 and
  PK86517.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 6.1.0.27.  Please refer to the Recommended Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PK78312

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSERVIC FEATU

• Fixed component ID

  5724J0850

Applicable component levels

• R610 PSY

     UP