Why is JBoss creating a new session with every JSP request?

Environment

• JBoss Enterprise Application Platform (EAP)
  • 6.x
  • 7.x
  • 8.x

Issue

• Why is JBoss creating a new session with every JSP request?

Resolution

• By default, JBoss compiles jsps to call getPageContext [1] with true for the needsSession boolean parameter. This results in the pageContext checking for a session on each JSP request. If one is provided by the client, that session is used, but if a session is not provided, then the pageContext initialization creates one.
• If seeing all these sessions created for requests from some particular client, consider who this client is and why he keeps sending requests without ever providing the sessions JBoss has generated. If the client is a loadbalancer or proxy that keeps sending health check requests, consider making the health check request to some static html page instead of a JSP.
• Also, that automatic session creation can be disabled for a JSP as described in How to disable http session creation in specific JSP. This would effectively change the needsSession boolean value used to false so that pageContext initialization does not create sessions.

[1] Content from docs.oracle.com is not included.http://docs.oracle.com/javaee/7/api/javax/servlet/jsp/JspFactory.html#getPageContext(javax.servlet.Servlet,%20javax.servlet.ServletRequest,%20javax.servlet.ServletResponse,%20java.lang.String,%20boolean,%20int,%20boolean)

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.