[ mx4j-Bugs-904049 ] Basic authentication fails

Bugs item #904049, was opened at 2004-02-25 08:01
Message generated for change (Comment added) made by doronf
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=450647&aid=904049&group_id=47745

Category: HTTP Adaptor
Group: Release 2.0.0
Status: Closed
Resolution: Invalid
Priority: 5
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Brian Scully (btscully)
Summary: Basic authentication fails

Initial Comment:
When using localhost, basic authentication will fail
to reject hostile login attempts. Even if you enter a
wrong password and get an exception, after browsing
and returning to the localhost:port, the MBeans are
showed.

Scenario:
1. Open a new browser with http://localhost:port
2. Type anything in the login dialog box.
3. You get an exception page. 
4. Browse to another address (you may use the MX4J
link).
5. Go back to the exception page-
!!! The MBeans appear !!! (See attached: MX4J_2.jpg)

I believe this has something to do to caching.
I looked for a cookie but didn't found any.

Doron Fediuk
[email protected]

----------------------------------------------------------------------

Comment By: Doron Fediuck (doronf)
Date: 2004-02-26 08:31

Message:
Logged In: YES 
user_id=983773

I'd like to confirm your response-
(as I suspected...) I cleared all the offline
caching of iexplore, and then failed on purpose.
I wasn't able to see the MBeans as described
after further navigation.

Thanks for the quick solution.
Doron.

----------------------------------------------------------------------

Comment By: Brian Scully (btscully)
Date: 2004-02-26 01:16

Message:
Logged In: YES 
user_id=234750

Okay - this one was hairy.  You are looking at the Internet 
Explorer cache.  MX4J is not serving the pages to you.  

To prove this to yourself, try to navigate into any of the links 
on the "leaked" page.  You will get 403 errors, even after 
navigating to another web page (your step 4).  My test case 
had two separate http adaptors on different ports.  One had 
authentication, the other did not.  They did not display the 
same data on the page.  IE keeps these two caches logically 
separate, so this also helps prove that you are looking at the 
IE cache.

I am closing this as invalid - if you have any questions or 
concerns, don't hesitate to post here.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=450647&aid=904049&group_id=47745


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click