Environment
Self Service Password Reset
SSPR 3.3
sspr.war renamed to root.war
Situation
SSPR error: 5028 ERROR_BAD_SESSION (client unable to reply with session key)
Browser appears to hang
Resolution
Renaming sspr.war to root.war isn't tested, and is not supported. Leave the file as sspr.war.
Additional Information
Sspr.war was renamed to root.war in order to avoid appending /sspr to the url. With the war file thus renamed, instead of pointing to https://myserver.com/sspr, users can point to https://myserver.com. This seems to work without error. But if users go directly to https://myserver.com/private/login their browser seems to hang.
There are several better ways to solve the problem. Here are a few:
1) Use apache in front of tomcat, apache can redirect requests to /sspr.
2) Use an empty root.war with just an index.html inside that in turn has a meta redirect to /sspr.
3) Edit the tomcat configuration to change the application path for sspr context to "/".