[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
4:03 a.m.
RememberMe Issue - Base 64 encoded cookie containing '=' is not processed
correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/jira/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.2.0.GA, 2.1.2.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:36 a.m.
New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/jira/browse/JBSEAM-4398?page=com.atlassian.jira.pl...
]
Miguel Cohnen commented on JBSEAM-4398:
---------------------------------------
Hi, I guess I'm facing the same issue. The cookie is added to the explorer and to my
Database, but no match is satisfied when trying to find it. Could you please provide some
information so that I can patch it on my side? I have not found where the encoding is
being done...
Thank you!
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/jira/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4 a.m.
New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/jira/browse/JBSEAM-4398?page=com.atlassian.jira.pl...
]
Sangeetha Radhakrishnan commented on JBSEAM-4398:
-------------------------------------------------
Hi Miguel,
Add the following line in your run.bat file:
set JAVA_OPTS=%JAVA_OPTS% "-Dorg.apache.catalina.
STRICT_SERVLET_COMPLIANCE=false"
This may fix your problem.
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/jira/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:02 a.m.
New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/jira/browse/JBSEAM-4398?page=com.atlassian.jira.pl...
]
Sangeetha Radhakrishnan commented on JBSEAM-4398:
-------------------------------------------------
Remove the space between catalina. and STRICT_SERVLET_COMPLIANCE and also double
quotation
set JAVA_OPTS=%JAVA_OPTS% -Dorg.apache.catalina.STRICT_SERVLET_COMPLIANCE=false
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/jira/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:24 a.m.
New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/jira/browse/JBSEAM-4398?page=com.atlassian.jira.pl...
]
Miguel Cohnen commented on JBSEAM-4398:
---------------------------------------
Hi Sangeetha,
thank you for your answer, but still the same issue. The cookie is succesfully placed in
the database. I can see in the traces that seam is performing a select on the cookies
Table, but I still got redirected to the login page, instead of login directly. My
Authentication Class is the same that you can find in the documentation (2.2) and I added
the same event handlers that are shown in the documentation as well.
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/jira/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:26 a.m.
New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/jira/browse/JBSEAM-4398?page=com.atlassian.jira.pl...
]
Miguel Cohnen commented on JBSEAM-4398:
---------------------------------------
<security:jpa-token-store
token-class="es.cohnen.pistayhora.entity.AuthenticationToken" />
<security:remember-me mode="autoLogin" />
<event type="org.jboss.seam.security.notLoggedIn">
<action execute="#{redirect.captureCurrentView}" />
<action execute="#{identity.tryLogin()}" />
</event>
<event type="org.jboss.seam.security.loginSuccessful">
<action execute="#{redirect.returnToCapturedView}" />
</event>
This are the relevant parts of my components.xml.
I don't know if it has something to do, but I', using drool based Authorization.
Thank you!
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/jira/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:59 a.m.
New subject: [jbossseam-issues] [JBoss JIRA] Assigned: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/jira/browse/JBSEAM-4398?page=com.atlassian.jira.pl...
]
Shane Bryzak reassigned JBSEAM-4398:
------------------------------------
Assignee: Shane Bryzak
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/jira/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
Assignee: Shane Bryzak
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:21 a.m.
New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/jira/browse/JBSEAM-4398?page=com.atlassian.jira.pl...
]
Peter Goldstein commented on JBSEAM-4398:
-----------------------------------------
For me resolving this issue required a code change. The following diff to the
RememberMe.java file resolved this issue for me:
93a94
cookieValue = cookieValue.replace("-",
"=");
222c223,224
< return Base64.encodeBytes(sb.toString().getBytes());
---
String retVal = Base64.encodeBytes(sb.toString().getBytes());
return retVal.replace("=", "-");
I'm happy to submit this in any other form that may be more useful, I just need some
guidance as to what's most helpful.
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/jira/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
Assignee: Shane Bryzak
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:25 p.m.
New subject: [jbossseam-issues] [JBoss JIRA] Updated: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/jira/browse/JBSEAM-4398?page=com.atlassian.jira.pl...
]
Shane Bryzak updated JBSEAM-4398:
---------------------------------
Fix Version/s: 3.0.0.BETA1
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/jira/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
Assignee: Shane Bryzak
Fix For: 3.0.0.BETA1
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:52 a.m.
New subject: [JBoss JIRA] Commented: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/jira/browse/JBSEAM-4398?page=com.atlassian.jira.pl...
]
Wulf Rowek commented on JBSEAM-4398:
------------------------------------
this issue has the same cause like https://jira.jboss.org/jira/browse/JBSEAM-3908
a better fix in my opinion is to use version-1-conform cookies in
org.jboss.seam.faces.Selector. just setting cookie.setVersion(1); in
setCookieValueIfEnabled, which forces tomcat to qoute outgoing cookie values containing
special chars and hence no truncating occurs when this cookie coming back, due to the
qoutes.
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/jira/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
Assignee: Shane Bryzak
Fix For: 3.0.0.BETA1
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:30 a.m.
New subject: [JBoss JIRA] Commented: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/jira/browse/JBSEAM-4398?page=com.atlassian.jira.pl...
]
Dieter Rehbein commented on JBSEAM-4398:
----------------------------------------
I had the same issue. It is simple to resolve: You have to use a cookie version 1, so the
fix should be made in class org.jboss.seam.faces.Selector:
{code}
protected void setCookieValueIfEnabled(String value)
{
FacesContext ctx = FacesContext.getCurrentInstance();
if ( isCookieEnabled() && ctx != null)
{
HttpServletResponse response = (HttpServletResponse)
ctx.getExternalContext().getResponse();
Cookie cookie = new Cookie( getCookieName(), value );
cookie.setMaxAge( getCookieMaxAge() );
cookie.setPath(cookiePath);
cookie.setVersion(1); // THIS IS THE FIX!!!
response.addCookie(cookie);
}
}
{code}
This solved the problem for me!
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/jira/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
Assignee: Shane Bryzak
Fix For: 3.0.0.BETA1
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:03 a.m.
New subject: [JBoss JIRA] Commented: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/jira/browse/JBSEAM-4398?page=com.atlassian.jira.pl...
]
Dieter Rehbein commented on JBSEAM-4398:
----------------------------------------
Unfortunately version 1 cookies do not work on IE (which once again proofs, that the blody
IE is the worst peace of software ......).
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/jira/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
Assignee: Shane Bryzak
Fix For: 3.0.0.BETA1
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:18 a.m.
New subject: [JBoss JIRA] Commented: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/browse/JBSEAM-4398?page=com.atlassian.jira.plugin....
]
bb bb commented on JBSEAM-4398:
-------------------------------
Related issues: https://jira.jboss.org/browse/JBAS-7372,
https://jira.jboss.org/browse/JBSEAM-4503
So rememberMe + s:token is casuses cookie problems
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
Assignee: Shane Bryzak
Fix For: 3.0.0.BETA1
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:20 a.m.
New subject: [JBoss JIRA] Issue Comment Edited: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/browse/JBSEAM-4398?page=com.atlassian.jira.plugin....
]
bb bb edited comment on JBSEAM-4398 at 11/26/10 7:19 AM:
---------------------------------------------------------
Related issues:
https://jira.jboss.org/browse/JBAS-7372
https://jira.jboss.org/browse/JBSEAM-4503
So rememberMe + s:token using probably casuses cookie problems
was (Author: babazs):
Related issues:
https://jira.jboss.org/browse/JBAS-7372
https://jira.jboss.org/browse/JBSEAM-4503
So rememberMe + s:token is casuses cookie problems
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
Assignee: Shane Bryzak
Fix For: 3.0.0.BETA1
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:20 a.m.
New subject: [JBoss JIRA] Issue Comment Edited: (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://jira.jboss.org/browse/JBSEAM-4398?page=com.atlassian.jira.plugin....
]
bb bb edited comment on JBSEAM-4398 at 11/26/10 7:18 AM:
---------------------------------------------------------
Related issues:
https://jira.jboss.org/browse/JBAS-7372
https://jira.jboss.org/browse/JBSEAM-4503
So rememberMe + s:token is casuses cookie problems
was (Author: babazs):
Related issues: https://jira.jboss.org/browse/JBAS-7372,
https://jira.jboss.org/browse/JBSEAM-4503
So rememberMe + s:token is casuses cookie problems
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://jira.jboss.org/browse/JBSEAM-4398
Project: Seam
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
Assignee: Shane Bryzak
Fix For: 3.0.0.BETA1
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:23 a.m.
New subject: [JBoss JIRA] (JBSEAM-4398) RememberMe Issue - Base 64 encoded cookie containing '=' is not processed correctly in some cases
[
https://issues.jboss.org/browse/JBSEAM-4398?page=com.atlassian.jira.plugi...
]
Chaithali R commented on JBSEAM-4398:
-------------------------------------
We have been using Jboss-seam 2.2.0 GA but unable to find catch for this. Shane Can you
provide me the patch for the same.
Thanks,
RememberMe Issue - Base 64 encoded cookie containing '=' is
not processed correctly in some cases
-------------------------------------------------------------------------------------------------
Key: JBSEAM-4398
URL: https://issues.jboss.org/browse/JBSEAM-4398
Project: Seam 2
Issue Type: Bug
Affects Versions: 2.1.2.GA, 2.2.0.GA
Environment: Observed on Windows Vista, JBoss 5.1.0 GA. Problem likely exists on
other operating systems and other Tomcat 6 based systems.
Reporter: Peter Goldstein
Assignee: Shane Bryzak
Fix For: The future
When attempting to use the RememberMe component in auto-login mode I discovered a bug in
the cookie handling of this component.
When attempting to log using an auth token I was encountering repeated failures - the
token was simply not being found in the database. After some investigation I discovered
that the problem was that the value parameter passed into the query was truncated by one
character - the last character was cut off.
I tracked the problem further back, and discovered that the truncated value originated in
JBoss' Tomcat. The cookie value being passed in was missing the last two '='
characters.
Some Google searching revealed that this was deliberate - Tomcat 6 in the JBoss 5.1.0 GA
configuration enforces strict character rules in the cookie value, which excludes
'='.
I'm not sure if Tomcat 6 is 'right' or not, but I do know that either way,
this is a trivial issue to address on the Seam side.
All one has to do is replace the '=' from the Base64 encoded token value with
another allowed character (say '_' or '-') before placing it in a cookie,
and reverse the process when reading a cookie.
I have a patch for this issue on the 2.2.0 GA code. I simply need to know how to submit
it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
4249
days inactive
5376
days old
15 comments
8 participants
participants (8)
-
bb bb (JIRA) -
Chaithali R (JIRA)
-
Dieter Rehbein (JIRA)
-
Miguel Cohnen (JIRA)
-
Peter Goldstein (JIRA)
-
Sangeetha Radhakrishnan (JIRA)
-
Shane Bryzak (JIRA)
-
Wulf Rowek (JIRA)