Re: Session Fixation etc

Klaus Berkling <[email protected]> Mon, 15 Feb 2016 10:26:39 -0800
Newsgroups gmane.comp.web.webobjects.wonder-disc
Message-ID <[email protected]>
--===============3518930669708248214==
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_74FE69F1-F3D9-4741-8B85-05CF79E6EC71"


--Apple-Mail=_74FE69F1-F3D9-4741-8B85-05CF79E6EC71
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8


> On Feb 15, 2016, at 9:29 AM, Issam Maamria <[email protected]> wrote:
>=20
> I have a question regarding sessions in WebObjects.
>=20
> I have a login direct action that accepts post requests for login. I =
want to ensure I create a fresh session upon successful login, and =
invalidate/ignore the session currently attached to the request (by =
means of wosid).
>=20
> At the moment, I am trying this in a subclass of WOContext to =
terminate session:
>=20
> public void terminateSession(){
>=20
>     if(hasSession()){
>=20
>            session().terminate();
>=20
>     }
>=20
>     _session =3D null;
>=20
> }
>=20
>=20
>=20
> and then obtaining a fresh session using context.session(). However, I =
am getting the 'checking out two sessions in R-R loop' error.
>=20

Your first session probably gets created by the login wocomponent page =
if you have that. If you do, make sure there aren=E2=80=99t any dynamic =
components on that page, and don=E2=80=99t make reference to objects in =
the component java class. Lots of things create sessions (including =
missing images, but that=E2=80=99s a different post).

If a hit to the login page generates a session and the user lets it sit =
for a while, you could get session termination errors when the user gets =
around to actually log in. Put a log statement in the session class to =
see when sessions are created.

The way I found around the multiple session issue is my making sure the =
login page does not generate a session at all.

Help this helps.

kib


--Apple-Mail=_74FE69F1-F3D9-4741-8B85-05CF79E6EC71
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D""><br class=3D""><div><blockquote type=3D"cite" class=3D""><div =
class=3D"">On Feb 15, 2016, at 9:29 AM, Issam Maamria &lt;<a =
href=3D"mailto:[email protected]" class=3D"">[email protected]</a>&gt; =
wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div =
dir=3D"ltr" class=3D""><div class=3D"">I have a question regarding =
sessions in WebObjects.</div><div class=3D""><br class=3D""></div><div =
class=3D"">I have a login direct action that accepts post requests for =
login. I want to ensure I create a fresh session upon successful login, =
and invalidate/ignore the session currently attached to the request (by =
means of wosid).</div><div class=3D""><br class=3D""></div><div =
class=3D"">At the moment, I am trying this in a subclass of WOContext to =
terminate session:</div><div class=3D""><br class=3D""></div><div =
class=3D""><p class=3D""><span class=3D"">public</span> <span =
class=3D"">void</span> terminateSession(){</p><p class=3D""><span =
class=3D""></span><span class=3D""></span><span class=3D"">&nbsp; &nbsp; =
if</span>(hasSession()){</p><p class=3D""><span class=3D""></span><span =
class=3D""></span><span class=3D""></span>&nbsp; &nbsp; &nbsp; &nbsp; =
&nbsp; &nbsp;session().terminate();</p><p class=3D""><span =
class=3D""></span><span class=3D""></span>&nbsp; &nbsp; }</p><p =
class=3D""><span class=3D""><span class=3D""></span><span =
class=3D""></span></span>&nbsp; &nbsp; _session<span class=3D""> =3D =
</span><span class=3D"">null</span><span class=3D"">;</span></p><p =
class=3D""><span class=3D"">	</span>}</p><p class=3D""><br =
class=3D""></p><p class=3D"">and then obtaining a fresh session using =
context.session(). However, I am getting the 'checking out two sessions =
in R-R loop' error.</p></div></div></div></blockquote></div><br =
class=3D""><div class=3D"">Your first session probably gets created by =
the login wocomponent page if you have that. If you do, make sure there =
aren=E2=80=99t any dynamic components on that page, and don=E2=80=99t =
make reference to objects in the component java class. Lots of things =
create sessions (including missing images, but that=E2=80=99s a =
different post).</div><div class=3D""><br class=3D""></div><div =
class=3D"">If a hit to the login page generates a session and the user =
lets it sit for a while, you could get session termination errors when =
the user gets around to actually log in. Put a log statement in the =
session class to see when sessions are created.</div><div class=3D""><br =
class=3D""></div><div class=3D"">The way I found around the multiple =
session issue is my making sure the login page does not generate a =
session at all.</div><div class=3D""><br class=3D""></div><div =
class=3D"">Help this helps.</div><div class=3D""><br class=3D""></div><div=
 class=3D"">kib</div><div class=3D""><br class=3D""></div></body></html>=

--Apple-Mail=_74FE69F1-F3D9-4741-8B85-05CF79E6EC71--


--===============3518930669708248214==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140
--===============3518930669708248214==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Wonder-disc mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/wonder-disc

--===============3518930669708248214==--