TechNote (Archived)

The J2EE Session URL Identifier JSESSIONID causes a 404 error when using IIS

Issue

When using ColdFusion MX while J2EE session variables are enabled, as defined in the ColdFusion Administrator, the session token jsessionid will be used to maintain state. If the application has planned for the possibility that clientside cookies are disabled for some users of the web application, then the application may have to use URLSessionFormat( ) to encode links within the application to maintain state by passing the session token in the URL. If so, the link URL's will have a semicolon delimited parameter appended to the URL. For example: page.cfm;jsessionid=1234.

With the use of the semicolon in this manner, the jsessionid parameter becomes part of the request path, not part of the request query string. Although this means of appending the jsession ID into the URL is a J2EE standard, this URL format may confuse some webservers, including Microsoft IIS. Instead, IIS may report a 404 error for Page Not Found if the ;jsessionid parameter appears in the request URL.

Solution

When using ColdFusion MX, this can be corrected by setting theignoresuffixmap property to false in the connector stub configuration file, jrun.ini. This file is typically found at cf_root/runtime/lib/wsconfig/1/jrun.ini orjrun_root/lib/wsconfig/1/jrun.ini. Once the change has been made, restart the webserver.

Note:The jrun.ini file will be located in the numbered directory corresponding to that webserver instance in the location cf_root\runtime\lib\wsconfig\{n}\, where n may be named 1 or 2 for example. For ColdFusion on JRun, the location will be jrun_root\lib\wsconfig\{n}\.

By setting this property to false, the JRun ISAPI filter will begin to match the URL for known extensions that should be handled by ColdFusion/JRun including *.cfm and *.jsp. When the JRun ISAPI filter matches the extension in a request, it will pass the request to the JRun server without letting IIS further parse the URL for extension mapping.

Here is an example from the connector log of JRun ISAPI filter matching a request by the .cfm extension, and properly handling the ;jsessionid parameter for the session:

 2004-07-14 11:57:14 jrISAPI[filter:1216]   In filter: notification = 0x00004000 2004-07-14 11:57:14 jrISAPI[filter:1216]   JRun Filter got url:   '/test.cfm;jsessionid=08301521611089820628281' 2004-07-14 11:57:14 jrISAPI[filter:1216] HOST: serat03:90 2004-07-14 11:57:14 jrISAPI[filter:1216]   filtering /test.cfm;jsessionid=08301521611089820628281   (/test.cfm) HOST=serat03:90 2004-07-14 11:57:14 jrISAPI[filter:1216] filterRequest: matched *.CFM 2004-07-14 11:57:14 jrISAPI[filter:1216]   JRun Filter mapped url to:   '/JRunScripts/jrun.dll/test.cfm;jsessionid=08301521611089820628281'.

In contrast, when the jrun.ini propertyignoresuffixmap is set to true, the JRun ISAPI filter will let IIS perform the extension matching. Here is an example from the connector log showing that JRun ISAPI filter has let the .cfm URL pass by, leaving IIS to make the match:

 2004-07-14 115015 jrISAPI[filter1216]   In filter notification = 0x00004000 2004-07-14 115015 jrISAPI[filter1216] JRun Filter got url   test.cfm;jsessionid=083053361089820211562' 2004-07-14 115015 jrISAPI[filter1216] HOST serat0390 2004-07-14 115015 jrISAPI[filter1216] filtering   test.cfm;jsessionid=083053361089820211562   (test.cfm) HOST=serat0390 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .cfml 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .CFML 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .cfm 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .cfc 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .CFM 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .CFC 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .cfml 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .CFML 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .jws 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .CFC 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .jst 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .CFM 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .cfc 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .jsp 2004-07-14 115015 jrISAPI[filter1216] filtering ignored suffix .cfm 2004-07-14 115015 jrISAPI[filter1216] filterRequest no match

In this last case, the JRun ISAPI filter let IIS perform the extension mapping and IIS failed to recognize the .cfm extension in the page request /test.cfm;jsessionid=083053361089820211562 because it couldn't distinguish .cfm from .cfm;jsessionid.