[Opensymphony-oscache] replacing jsession in cached content

I didn't post the Jira issue but this is what I think it means:

Provide the possibility to always regenerate the content (ignore the cache) if  the session supplied with the request is tracked via URL (jsessionid exists the URL).

Then I could safely include <%=response.encodeUrl()%> links in my cached content. It is safe for both cookie- and url-rewriting sessions. The downside of course is that the content is not served from cache in the latter case. But still way better than a security nightmare.

I found some (ugly) workaround, which does more or less the same:
<cache:cache key="<%="index_lat" + request.isRequestedSessionIdFromURL()%>" time="30" scope="application" refresh="<%=request.isRequestedSessionIdFromURL()%>">

It reads like this: There are different cache keys for cookie and url-sessions. If it's url-session, the refresh attribute forces to regenerate the content.

---------------------------------------------------------------------
Posted via Jive Forums
http://forums.opensymphony.com/thread.jspa?threadID=304&messageID=4214#4214