jakarta ee - What does the crossContext attribute do in Tomcat? Does it enable session sharing?

Question

All I can find in the Tomcat 5.5 docs is:

Set to true if you want calls within this application to ServletContext.getContext() to successfully return a request dispatcher for other web applications running on this virtual host. Set to false (the default) in security conscious environments, to make getContext() always return null.

I've found some forum posts that comment that setting crossContext=true also enables sharing the session object between different web applications, but I'm not able to find any official docs stating this.

Is there a relation between Servlet.getContext() and the ability to share session state between different web applications?

What does the crossContext attribute really do in Tomcat?

Answer 1

You can share sessions between web applications by using a Single Sign-On Valve.

You would set crossContext=true if you wanted to share some information between different Web Applications in the same Virtual Host.

For example app1 would call:

setAttribute("name", object);

and another app could call

getContext("/app1").getAttribute("name");

to read the information. If crossContext wasn't set to true, the getContext("/app1") would have returned null.

However, the use of crossContext is both rare and potentially insecure.