Jetty keeps Sessions in use after "Duplicate valid session cookies" Message #6085

Activity

1. janbartel commented on Mar 23, 2021

   

   janbartel

   on Mar 23, 2021

   Contributor

   More actions

   @ssoec4u I will put in a fix for this to ensure that duplicate valid sessions have their request counts decremented correctly.

   But how the heck did you manage to get multiple sessions with different ids created, and moreover get the client to send more than 1 JSESSIONID cookie?

   Also, you're more than 10 releases of jetty behind, it would be best if you could upgrade.
2. janbartel

   added 2 commits that reference this issue on Mar 23, 2021

   Issue #6085 Fix reference counts for multiple valid cookies for sesss…

   ...

   76a2363

   Issue #6085 Fix reference counts for multiple valid cookies for sessi…

   ...

   6d8ae9c
3. janbartel commented on Mar 24, 2021

   

   janbartel

   on Mar 24, 2021

   Contributor

   More actions

   Fixed via #6088.
4. janbartel

   closed this as completedon Mar 24, 2021
5. janbartel

   self-assigned this

   on Mar 24, 2021
6. janbartel

   added 2 commits that reference this issue on Mar 24, 2021

   Issue #6085 Fix reference counts for multiple valid cookies for sessi…

   ...

   20dd419

   Issue #6085 Fix reference counts for multiple valid cookies for sessi…

   ...

   fd05a3d
7. gregw

   reopened this on Mar 25, 2021
8. gregw

   linked a pull request that will close this issueIssue #6085 Fix reference counts for multiple valid cookies for sessions #6096on Mar 25, 2021
9. gregw

   closed this as completedon Mar 25, 2021
10. ssoec4u commented on Mar 25, 2021

    

    ssoec4u

    on Mar 25, 2021

    Author

    More actions

    @ssoec4u I will put in a fix for this to ensure that duplicate valid sessions have their request counts decremented correctly.

    But how the heck did you manage to get multiple sessions with different ids created, and moreover get the client to send more than 1 JSESSIONID cookie?

    Also, you're more than 10 releases of jetty behind, it would be best if you could upgrade.

    The problem can be understood if you call up a web link from an Excel (Microsoft) in a Window 10 with the current IE Edge. The condition is that the website uses session cookies for this.
    If you then call up the link at least twice, the message appears in the log file.
11. janbartel

    added a commit that references this issue on Mar 25, 2021

    Issue #6085 Fix duplicate valid session cookies to pick first valid.

    ...

    c1cb9fe
12. janbartel

    linked a pull request that will close this issueIssue #6085 Fix duplicate valid session cookies to pick first valid. #6103on Mar 25, 2021
13. sbordet

    added 9 commits that reference this issue on Mar 25, 2021

    Issue #6085 Fix duplicate valid session cookies to pick first valid.

    ...

    2cd5990

    Issue #6085 Fix duplicate valid session cookies to pick first valid.

    ...

    1aa1ca4

    Issue #6085 Fix duplicate valid session cookies to pick first valid.

    ...

    eb7e588

    Issue #6085 Fix duplicate valid session cookies to pick first valid.

    ...

    c4e3f54

    Issue #6085 Fix duplicate valid session cookies to pick first valid.

    ...

    af042ba

    Issue #6085 Fix duplicate valid session cookies to pick first valid.

    ...

    64006c6

    Issue #6085 Fix duplicate valid session cookies to pick first valid.

    ...

    f6afdc5

    Issue #6085 Fix duplicate valid session cookies to pick first valid.

    ...

    4356277

    Issue #6085 Fix duplicate valid session cookies to pick first valid.

    ...

    e068119
14. kapitaali commented on Aug 8, 2026

    

    kapitaali

    on Aug 8, 2026

    More actions

    I'm running into this same issue with Jetty 12.1.11.

    I'm running Jetty embedded via a language runtime's HTTP server library (Kap's httpserver2), which is not a typical WAR deployment. The server starts via a script (kap main.kap) that I've been killing and restarting very frequently during iterative development (probably 20-30 times over the course of an extended debugging session), each restart spinning up a brand-new process with a completely fresh in-memory session table.

    Throughout that whole session I kept the same browser tab open against http://localhost:8080, logging in, testing, restarting the server, and logging in again — without ever manually clearing cookies between restarts. So the sequence was something like: log in (session A created, cookie set) → kill server → restart server (fresh session store, no memory of session A) → log in again in the same tab (session B created) → repeat several more times.

    Eventually a request came in that got rejected with:

    HTTP ERROR 400 Duplicate sessions: kap-httpserverXXXXX...[valid,cookie] & kap-httpserverYYYYY...[valid,cookie]
    

    So it looks like the browser ended up holding onto more than one cookie for the session cookie name/path at once, presumably accumulated across some subset of those restarts, and eventually sent more than one in a single request.

    My app touches the session from two different URL path prefixes in a row during a single login: first at POST /dologin (root-level path), then immediately after (via redirect) at GET /admin/posts (nested under /admin). My cookie jar shows exactly two JSESSIONID cookies, one scoped Path=/ and one scoped Path=/admin — which lines up precisely with those two touch points. So it looks like session cookies are being scoped to wherever the session was first accessed from, rather than defaulting to the application root — and when a later request under a different prefix doesn't carry the first cookie back (or isn't recognized as the same session), a second session gets created, and now two valid ones collide. Does that match what you'd expect from the code path this hits?