I'm facing some issues with Apache mod_proxy_balancer regarding sticky sessions.
We've developped a restful webservice in Java, running on Tomcat. The actual backend is using Acegi security, with Auth Basic authentication.
The architecture is (sorry I'm a new user, I can't post images) :
--------------------
|Java Reverse Proxy|
--------------------
|
--------------------
|Apache load balancer|
--------------------
|
--------|--------
| |
-------- --------
|tomcat1| |tomcat2|
-------- --------
We have this "Java Reverse Proxy" to perform various business things. It also does the Basic Auth authentication on the Tomcat (Tomcat1, Tomcat2).
The end-user calls urls like : http:///a/b?username=foo&password=bar&session=xxx
The reverse proxy then proxies the request to Apache, sending along the credentials as Basic Auth tokens.
The end-user has three different urls:
http://<java reverse proxy domain>/service1
http://<java reverse proxy domain>/service2
http://<java reverse proxy domain>/service3
Only service1 and service2 are protected through Acegi. service3 is anonymously accessible (this is a requirement).
We've have the following configuration in Apache to perform the load balancing:
<Proxy balancer://cluster>
Header set Cache-Control no-cache
Header set Pragma no-cache
BalancerMember http://xxx:9671 route=server1
BalancerMember http://xxx:9672 route=server2
</Proxy>
ProxyPreserveHost On
ProxyPass / balancer://cluster/ stickysession=JSESSIONID
ProxyPassReverse / balancer://cluster/ stickysession=JSESSIONID
On the first call to service1, then JSESSIONID is returned to the user, and then he sends this session information as part of the request (in t