Details
-
Type:
Bug
-
Status:
Resolved
-
Priority:
Minor
-
Resolution: Fixed
-
Affects Version/s: 7.6.4
-
Component/s: Security and SSL
-
Labels:None
-
Number of attachments :
Description
There seems to be a bug in renewSessionOnAuthentication when using BASIC authentication, which is confusing our web applications.
What happens is:
1) First request -> user is required to authenticate -> serves HTML page.
2) HTML page pulls in additional resources, but the first one of them arriving triggers renewSessionOnAuthentication() code which changes the session ID, and invalidates the second request.
The offending code seems to be in :
LoginAuthenticator.renewSessionOnAuthentication(HttpServletRequest request, HttpServletResponse response)
{
if (_renewSession && httpSession!=null && httpSession.getAttribute(SESSION_SECURED)==null)
...
httpSession.invalidate();
httpSession = request.getSession(true);
httpSession.setAttribute(SESSION_SECURED,Boolean.TRUE);
...
}
If I read this correctly and interpret what we see, then it seems that even though a session has been authenticated already, but the SESSION_SECURED attribute is not yet set (it is only set in this code ?), the session will be invalidated and only then this attribute is set.
Koen,
The easy workaround for you is to call SessionHandler.setSessionRenewedOnAuthentication(false) for that webapp. Depending on how you set up jetty, either do it in code or in a context xml file.
Meanwhile, I will look into changing our impl to avoid the problem. The only way I can see this happening is if you do not have a session already at the time the 1st request is authenticated. Do you have a small webapp I can use as a test harness?
thanks
Jan