Spring Security login won't work when dealing with 2 tomcat and nginx - spring

Question

I have two same webapps deployed on tomcat at 127.0.0.1:8090 and 127.0.0.1:8091. I want to distribute requests between these two apps, so I config the nginx like this:
upstream my_servers {
server 127.0.0.1:8090;
server 127.0.0.1:8091 backup;
}
server {
listen 80;
server_name *.testabcd.com;
charset utf-8;
location /myapp {
proxy_pass http://my_servers;
}
}
Everything worked fine then. So I moved forward, removed the "backup", the config now looks like this:
upstream my_servers {
server 127.0.0.1:8090;
server 127.0.0.1:8091;
}
server {
...
}
However, my app's login just wouldn't take any effect! I visit http://testabcd.com/my_servers/hello/ and it keep returning the login page!
Below is some details of my app:
My webapp is working with Spring Security 3.1.4, and the login configuration part in the applicationContext.xml is like this:
<sec:http auto-config="true" use-expressions="true">
<sec:intercept-url pattern="/login" access="permitAll"/>
<sec:intercept-url pattern="/logout" access="permitAll"/>
<sec:intercept-url pattern="/access_denied" access="permitAll"/>
<sec:form-login login-page="/login" default-target-url="/" authentication-failure-url="/access_denied"/>
<sec:logout logout-success-url="/logout"/>
<sec:intercept-url pattern="/hello/*" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')"/>
</sec:http>
My web.xml:
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
The login.jsp：
<%# page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8" %>
<%# taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%# taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
<%# page isELIgnored="false" %>
<form id="form2" action="<c:url value='/j_spring_security_check'/>" method="post">
<label>email:</label>
<input type="text" id="j_username" name="j_username" value="${sessionScope['SPRING_SECURITY_LAST_USERNAME']}"/><br/>
<label>password:</label>
<input type="password" id="j_password" name="j_password"/><br/>
<label>rememberme:</label>
<input type="checkbox" name="_spring_security_remember_me" />
<br/>
<input type="submit" value="Login" />
</form>
The controller:
#Controller
#RequestMapping("/")
public class HelloController {
#RequestMapping(value = "login")
public String login() {
return "login";
}
}

Answer 1

Have you tried to debug which backend servers the requests are actually being routed to? The nginx upstream module apparently uses round-robin load balancing, so what you're observing seems normal. You login and start a session on one backend server, and subsequently arrive at a different one which has no knowledge of the session (unless you are clustering sessions between them which I'd guess not).
Ideally you'll need to use a sticky-session load-balancer, based on the JSESSIONID cookie. I don't think nginx supports this out of the box, but you can set the ip_hash directive so that individual IP addresses always use the same backend server.