What's the best approach to distributed/parallel sessions in a multi-container environment? We have a Redis service so thought it would be easy to config the Lucee containers to store them there, but apparently that only works with CFML sessions and ours are J2EE.

'raise issues in pentests' == actual issues or just 'some automated software says it recognizes cfid/cfsession'

We've been using J2EE sessions for years now and would prefer not to have to go back to cfid/cftoken. Is it definitely the case that J2EE won't work with distributed session storage?

I don't think it's definitely the case. I know we had some issues trying out J2EE sessions a while back. We use redis for session storage but we don't actually use the session scope for it -- found it easier to just use calls to an object cache with

onRequestStart

and

onRequestEnd

Interesting, Samuel, thanks. At this point I'd prefer not have to start rolling my own sessions. Would much rather use the built-in cache storage config if possible. It looks so simple.

We're on Lucee - I expect there are some differences in how they handle Redis storage, just knowing about how Lucee has dealt with this in the past

Right. From what Mark Drew was saying I assumed this was a general servlet problem. Guess the only way to find out is to test with the latest Lucee.