Re: Session Fixation etc
Klaus Berkling <[email protected]> Mon, 15 Feb 2016 10:26:39 -0800
| Newsgroups | gmane.comp.web.webobjects.wonder-disc |
|---|---|
| Message-ID | <[email protected]> |
--===============3518930669708248214== Content-Type: multipart/alternative; boundary="Apple-Mail=_74FE69F1-F3D9-4741-8B85-05CF79E6EC71" --Apple-Mail=_74FE69F1-F3D9-4741-8B85-05CF79E6EC71 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Feb 15, 2016, at 9:29 AM, Issam Maamria <[email protected]> wrote: >=20 > I have a question regarding sessions in WebObjects. >=20 > I have a login direct action that accepts post requests for login. I = want to ensure I create a fresh session upon successful login, and = invalidate/ignore the session currently attached to the request (by = means of wosid). >=20 > At the moment, I am trying this in a subclass of WOContext to = terminate session: >=20 > public void terminateSession(){ >=20 > if(hasSession()){ >=20 > session().terminate(); >=20 > } >=20 > _session =3D null; >=20 > } >=20 >=20 >=20 > and then obtaining a fresh session using context.session(). However, I = am getting the 'checking out two sessions in R-R loop' error. >=20 Your first session probably gets created by the login wocomponent page = if you have that. If you do, make sure there aren=E2=80=99t any dynamic = components on that page, and don=E2=80=99t make reference to objects in = the component java class. Lots of things create sessions (including = missing images, but that=E2=80=99s a different post). If a hit to the login page generates a session and the user lets it sit = for a while, you could get session termination errors when the user gets = around to actually log in. Put a log statement in the session class to = see when sessions are created. The way I found around the multiple session issue is my making sure the = login page does not generate a session at all. Help this helps. kib --Apple-Mail=_74FE69F1-F3D9-4741-8B85-05CF79E6EC71 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D""><br class=3D""><div><blockquote type=3D"cite" class=3D""><div = class=3D"">On Feb 15, 2016, at 9:29 AM, Issam Maamria <<a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a>> = wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div = dir=3D"ltr" class=3D""><div class=3D"">I have a question regarding = sessions in WebObjects.</div><div class=3D""><br class=3D""></div><div = class=3D"">I have a login direct action that accepts post requests for = login. I want to ensure I create a fresh session upon successful login, = and invalidate/ignore the session currently attached to the request (by = means of wosid).</div><div class=3D""><br class=3D""></div><div = class=3D"">At the moment, I am trying this in a subclass of WOContext to = terminate session:</div><div class=3D""><br class=3D""></div><div = class=3D""><p class=3D""><span class=3D"">public</span> <span = class=3D"">void</span> terminateSession(){</p><p class=3D""><span = class=3D""></span><span class=3D""></span><span class=3D""> = if</span>(hasSession()){</p><p class=3D""><span class=3D""></span><span = class=3D""></span><span class=3D""></span> = session().terminate();</p><p class=3D""><span = class=3D""></span><span class=3D""></span> }</p><p = class=3D""><span class=3D""><span class=3D""></span><span = class=3D""></span></span> _session<span class=3D""> =3D = </span><span class=3D"">null</span><span class=3D"">;</span></p><p = class=3D""><span class=3D""> </span>}</p><p class=3D""><br = class=3D""></p><p class=3D"">and then obtaining a fresh session using = context.session(). However, I am getting the 'checking out two sessions = in R-R loop' error.</p></div></div></div></blockquote></div><br = class=3D""><div class=3D"">Your first session probably gets created by = the login wocomponent page if you have that. If you do, make sure there = aren=E2=80=99t any dynamic components on that page, and don=E2=80=99t = make reference to objects in the component java class. Lots of things = create sessions (including missing images, but that=E2=80=99s a = different post).</div><div class=3D""><br class=3D""></div><div = class=3D"">If a hit to the login page generates a session and the user = lets it sit for a while, you could get session termination errors when = the user gets around to actually log in. Put a log statement in the = session class to see when sessions are created.</div><div class=3D""><br = class=3D""></div><div class=3D"">The way I found around the multiple = session issue is my making sure the login page does not generate a = session at all.</div><div class=3D""><br class=3D""></div><div = class=3D"">Help this helps.</div><div class=3D""><br class=3D""></div><div= class=3D"">kib</div><div class=3D""><br class=3D""></div></body></html>= --Apple-Mail=_74FE69F1-F3D9-4741-8B85-05CF79E6EC71-- --===============3518930669708248214== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Site24x7 APM Insight: Get Deep Visibility into Application Performance APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month Monitor end-to-end web transactions and take corrective actions now Troubleshoot faster and improve end-user experience. Signup Now! http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140 --===============3518930669708248214== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Wonder-disc mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/wonder-disc --===============3518930669708248214==--