Managing Cookies in a Cluster

In a multi-server cluster there is a possibility that different URLs can be used to access the same web application. For example, if you host multiple applications you might expose the same app using different addresses:

• stock.myapplication.com

• myapplication.com/stock

In Mode-2 each slave uses different URLs and sessions are redirected to those URLs. Unlike Mode-0 where there is only one entry URL to the system, in Mode-2 there can be multiple URLs. This poses a problem when your application uses cookies to manage sessions: cookies are scoped to domains and URLs, so cookies saved for www.domain1.com are not visible from www.domain2.com.

Solution: use the same web domain for the master and all its slaves

• Assign subdomain URLs of your main domain to your slaves so all nodes share a common domain.

• Example domain: myapplication.com

Valid setup for cookie sharing:

• Master server URL:

  • www.myapplication.com or myapplication.com

• Slaves URLs:

  • srv0.myapplication.com

  • srv1.myapplication.com

  • slavex.myapplication.com

  • app2.myapplication.com

If some of your slaves are on different top-level domains, they will not be able to access common cookies. Example of non-compatible slaves:

• myslave0.com

• myslave1.com

Configuration parameter

• To enable domain-wide cookies in the cluster, set the configuration parameter domain_cookies to 1 in the related CFG file.

• This parameter is disabled by default to maintain backward compatibility.

• If your cluster is a single-server HyperServer instance, set domain_cookies in that server's CFG file.

• In a multi-server farm, it is sufficient to enable the parameter on the master server only; the master will automatically propagate this setting to all slave servers.

• When enabled, uniGUI automatically adds the correct DOMAIN attribute to cookies when they are set.

Important: After enabling this feature in a multi-server cluster, cookies will be available to all subdomains of the cluster. This can be a problem for multi-application clusters because all cookies will be visible to all applications.

• If you want cookies to be private to a particular application, use distinct cookie names per application to avoid one application overwriting another's cookies.

• Conversely, this feature can be used intentionally to share cookies (for example, shared login information) across multiple applications.

Note: Starting from build 1559 you can enable this feature by setting domain_cookies=1. This requires compiling all Nodes with build 1559 as well. When enabled, all Nodes regardless of cluster mode provide a DOMAIN parameter when setting cookies.