Apache LoadBalancing, sticky session, and Spring security framework - apache2

Question

I have a public facing Apache 2.2 webserver that I've configured to proxy and balance requests to back-end web applications deployed on Tomcat 6.0. I am using Spring FW + Spring security framework as technology stack, therefore the application is using a cookie with jsessionid. The snippet below is from the Apache configuration:
ServerName abc.mydomain.com
ProxyRequests Off
ProxyPass / balancer://mycluster/ stickysession=JSESSIONID|jsessionid nofailover=On scolonpathdelim=On
ProxyPassReverse / balancer://mycluster/
<Proxy balancer://mycluster >
BalancerMember http://10.179.40.165:8080/abc
</Proxy>
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Location />
Order allow,deny
Allow from all
</Location>
The problem is that Spring Security will redirect to invalid session url on any request after a successful login. What can I do to solve the problem?
Thanks
Peter

Answer 1

i just had this issue as well.
found the answer in https://stackoverflow.com/a/9951315/1211174
here is my configuration:
<VirtualHost vm1.mydomain.com:443>
ServerName public.domain.name
<IfModule mod_proxy.c>
ProxyRequests Off
ProxyTimeout 5400
#should be the otherway. white list instead of black list
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Proxy balancer://mybalancername>
BalancerMember ajp://localhost:8209
BalancerMember ajp://localhost:8210
ProxySet lbmethod=bytraffic
ProxySet stickysession=JSESSIONID
</Proxy>
ProxyPass / balancer://mybalancername/
#check out http://httpd.apache.org/docs/2.2/mod/mod_proxy_ajp.html for more info
ProxyPassReverse / balancer://mybalancername/
ProxyPassReverseCookieDomain balancer://mybalancername https://public.domain.name
</IfModule>
seems like that with out
ProxySet lbmethod=bytraffic
ProxySet stickysession=JSESSIONID
spring security doesnt get the right cookie