Search code examples
jsfsession-cookieswebsphere-libertyopen-liberty

UnauthorizedSessionRequestException: SESN0008E If user leaves application inactive in browser for some time

I keep getting following error in my JSF application when I leave app sitting in browser for some time, then try using it again;

com.ibm.websphere.servlet.session.UnauthorizedSessionRequestException: SESN0008E: A user authenticated as anonymous has attempted to access a session owned by user:localRealm/uid=testUser,ou=People,o=internet.

My Liberty settings.xml file has following settings that could be related:

<ltpa expiration="1200" />
<webAppSecurity logoutOnHttpSessionExpire="true" singleSignonEnabled="true" />

My web.xml has

<session-config>
    <session-timeout>60</session-timeout>
</session-config>

What is causing this error and how to resolve it?

Solution

  • I figured it out.

    SESN0008E happens when LTPA token expires before than user session (HttpSession in your app) expires.

    In JSF, we normally have Http session expiration time set in web.xml file like:

    <session-config>
    <session-timeout>60</session-timeout>
</session-config>

    This means user session (HttpSession) will expire in 60 minutes.

    For Liberty (Websphere or Openliberty), we typically set LTPA token expiration in server.xml file like:

    <ltpa expiration="120" />

    This means that Libety LTPA token will expire in 120 minutes.

    REPRODUCTION STEPS

    1. Set above ltpa expiration="1" to set it to 1 minute
    2. set above session-timeout to 5 minutes. (This will make your ltpa token expire before your Http session expires.)
    3. Start your app and login in
    4. do something in it, like search or whatever you do then wait just above your ltpa expiration time of 1 minute. Basically, make it inactive to 1+ minutes but less than 5 minutes
    5. Now try doing something again like search or whatever your app does and it should result with SESN0008E exception (• UnauthorizedSessionRequestException).

    SOLUTION

    • Leave above settings as they are
    • In server.xml add <httpSession invalidateOnUnauthorizedSessionRequestException="true"/>
    • Repeat same steps as in REPRODUCTION STEPS and your application will no longer throw SESN0008E but will instead take you back to login screen where you can login and continue your work

    MORE INFORMATION