PH60833: When Security Audit is enabled, an HTTP Session will be started if non exists.

APAR status

• Closed as program error.

Error description

• An application that expects to delay creation of the HTTP
  Session, or take special action on requests that arrive
  without an established HTTP Session will find the session is
  always pre-established.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: Enabling Security Audit causes a        *
  *                      session management issue as it          *
  *                      establishes an HTTP session on any      *
  *                      request with no established session.    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When Security Audit is enabled, it unconditionally calls
  request.getSession() causing a session to be created if none
  exists yet. However, some applications may want to delay
  session creation or take special action on the initial request
  of a session.
  

Problem conclusion

• The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.27 and 9.0.5.21.
  For more information, see 'Recommended Updates for WebSphere
  Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels