Search code examples
google-chromecookiesspring-securitysession-cookiesandroid-browser

Session cookie not remove on browser close


For chrome and android stock browser, JSESSIONID cookie parameter are not removed even on browser close. As most of the websites are tracking customer session with JSESSIONID cookie which is having expire time of session, is not being removed from browser memory even browser closes.

Due to that, when we are accessing the webpage again, first request is sent with existing session cookie value.

If application is running with multiple servers for load balancing, request is sent to same server all the time. Is there any solution to solve the issue?

Reference Link : Cookie issue


Solution

  • As this is known security bug in latest browsers, issue is getting resolved by removing session cookies manually on every launch of the application.

    Even if the server is already taken care of expired session, connection establishment with server needs to be dynamic based on load availability in each server. As server name also stored in cookie and this value is not removed even browser / application is getting closed, first request on every application launch will connecting to the same server which is connected earlier.

    Because of this, load balancing is getting failure because of unremoved cookies.

    Eventhough this is technically reliable workaround, i hope in upcoming chrome browser versions will resolve this issue permanently similar to safari/IE browsers.

    If anyone find out permanent solution, please share your findings as well.