[jetty-dev] [jira] (JETTY-1529) Superfluous re-authenticate changes session ID uncoditionally on second request

Koen Deforche
created JETTY-1529

Superfluous re-authenticate changes session ID uncoditionally on second request

Issue Type:

Bug

Affects Versions:

7.6.4

Assignee:

Unassigned

Components:

Security and SSL

Created:

28/Jun/12 3:18 PM

Description:

There seems to be a bug in renewSessionOnAuthentication when using BASIC authentication, which is confusing our web applications.

What happens is:

1) First request -> user is required to authenticate -> serves HTML page.

2) HTML page pulls in additional resources, but the first one of them arriving triggers renewSessionOnAuthentication() code which changes the session ID, and invalidates the second request.

The offending code seems to be in :

LoginAuthenticator.renewSessionOnAuthentication(HttpServletRequest request, HttpServletResponse response)
{
if (_renewSession && httpSession!=null && httpSession.getAttribute(SESSION_SECURED)==null)
...
httpSession.invalidate();
httpSession = request.getSession(true);
httpSession.setAttribute(SESSION_SECURED,Boolean.TRUE);
...
}

If I read this correctly and interpret what we see, then it seems that even though a session has been authenticated already, but the SESSION_SECURED attribute is not yet set (it is only set in this code ?), the session will be invalidated and only then this attribute is set.

Project:

Jetty

Priority:

Minor

Reporter:

Koen Deforche

This message is automatically generated by JIRA.

If you think it was sent incorrectly, please contact your JIRA administrators .

For more information on JIRA, see: http://www.atlassian.com/software/jira

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

http://xircles.codehaus.org/manage_email