What does the crossContext attribute do in Tomcat? Does it enable session sharing?

Question

All I can find in the Tomcat 5.5 docs is:

Set to true if you want calls within this application to ServletContext.getContext() to successfully return a request dispatcher for other web applications running on this virtual host. Set to false (the default) in security conscious environments, to make getContext() always return null.

I've found some forum posts that comment that setting crossContext=true also enables sharing the session object between different web applications, but I'm not able to find any official docs stating this.

Is there a relation between Servlet.getContext() and the ability to share session state between different web applications?

What does the crossContext attribute really do in Tomcat?

Answer 1

From the javadoc ServletContext.getContext():

This method allows servlets to gain access to the context for various parts of the server, and as needed obtain RequestDispatcher objects from the context. The given path must be begin with "/", is interpreted relative to the server's document root and is matched against the context roots of other web applications hosted on this container.

So for instance if you want to include a page from a different webapp you need to set crossContext to true.

Answer 2

You can share sessions between web applications by using a Single Sign-On Valve.

You would set crossContext=true if you wanted to share some information between different Web Applications in the same Virtual Host.

For example app1 would call:

setAttribute("name", object);

and another app could call

getContext("/app1").getAttribute("name");

to read the information. If crossContext wasn't set to true, the getContext("/app1") would have returned null.

However, the use of crossContext is both rare and potentially insecure.

Answer 3

I tried it myself and I can't find the magical session sharing side effect, so the crossContext attribute only does what the docs say.

I've posted another question to see if there is a way to share the session state.