[JBoss JIRA] (WFLY-12375) Server returns 2 JSESSIONID cookies
by Nicolas NESMON (Jira)
[ https://issues.jboss.org/browse/WFLY-12375?page=com.atlassian.jira.plugin... ]
Nicolas NESMON commented on WFLY-12375:
---------------------------------------
Yes that' it.
Its results in the creation of a session cookie (JSESSIONID or whatever session cookie name you set in web.xml) when session object does not exist.
> Server returns 2 JSESSIONID cookies
> ------------------------------------
>
> Key: WFLY-12375
> URL: https://issues.jboss.org/browse/WFLY-12375
> Project: WildFly
> Issue Type: Bug
> Components: Web (Undertow)
> Affects Versions: 17.0.1.Final
> Reporter: Nicolas NESMON
> Assignee: Flavia Rainone
> Priority: Major
> Labels: COOKIES, JSESSIONID
>
> Please find below the source code of my simplified JAX-RS application:
> {code:java}
> @ApplicationPath("myApp")
> public class Application extends javax.ws.rs.core.Application {
> public Application() {
> }
> @Override
> public Set<Object> getSingletons() {
> return Collections.singleton(new HelloWorldResource());
> }
> }
> {code}
> {code:java}
> @Path("/")
> @Produces(MediaType.TEXT_PLAIN)
> public class HelloWorldResource {
> @Context
> private HttpServletRequest httpServletRequest;
> @GET
> public Response helloWorld() {
> HttpSession session = this.httpServletRequest.getSession(false);
> return Response.ok(session == null ? "Hello world" : "Bye bye world")
> .cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
> }
> }
> {code}
> When deploying this application in WF 17.0.1.Final and running following request:
> {noformat}
> GET http://localhost:8080/demo/myApp/
> Host: localhost:8080
> User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
> Accept-Encoding: gzip, deflate
> Connection: keep-alive
> Upgrade-Insecure-Requests: 1
> Pragma: no-cache
> Cache-Control: no-cache
> Cookie: JSESSIONID=Hello => without this cookie, I only get the cookie I created.
> {noformat}
> I get following response
> {noformat}
> HTTP/1.1 200 OK
> Connection: keep-alive
> Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
> Set-Cookie: JSESSIONID=hello.vpi070236; path=/demo
> Content-Type: text/plain;charset=UTF-8
> Content-Length: 11
> Date: Tue, 13 Aug 2019 23:28:15 GMT
> {noformat}
> As you may notice, there are 2 JSESSIONID cookies in the response:
> * The one I was expecting with "id" value since I created it.
> * Another one created by the server even if I did not ask for it since in my code I don't create no HTTP session. And by the way this JSESSIONID cookie is created but there no server side session created...weird
> Any idea why this second JSESSIONID cookies is created by the server ?
> Since my real application don't use HTTP session at all the workaround I found is to set session tracking mode to URL:
> {noformat}
> <web-app>
> <session-config>
> <tracking-mode>URL</tracking-mode>
> </session-config>
> </web-app>
> {noformat}
> Thanks
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months
[JBoss JIRA] (WFCORE-4603) Replace Deployment --runtime-name option not working
by Brian Stansberry (Jira)
[ https://issues.jboss.org/browse/WFCORE-4603?page=com.atlassian.jira.plugi... ]
Brian Stansberry commented on WFCORE-4603:
------------------------------------------
[~ehugonnet] [~yersan] A tangent to clean up as part of any work on this:
https://github.com/wildfly/wildfly-core/blob/master/server/src/main/java/...
That should be context.readResource(PathAddress.EMPTY_ADDRESS, false); as we don't want to read the entire model just to check for child names.
> Replace Deployment --runtime-name option not working
> ----------------------------------------------------
>
> Key: WFCORE-4603
> URL: https://issues.jboss.org/browse/WFCORE-4603
> Project: WildFly Core
> Issue Type: Bug
> Affects Versions: 10.0.0.Beta4
> Environment: Red Hat JBoss Enterprise Application Platform (EAP) 7.2 CP 3.
> Reporter: Emmanuel Hugonnet
> Assignee: Emmanuel Hugonnet
> Priority: Major
>
> The scenario is that, if you have a deployment to be switched by a new one, the runtime-name property doesn't work the way it should. See the sequence of the commands bellow:
> [standalone@localhost:9990 /] deploy helloworld-rs.war
> [standalone@localhost:9990 /] deploy helloworld-rs-second.war —disabled
> [standalone@localhost:9990 /] :replace-deployment(name=helloworld-rs-second.war,to-replace=helloworld-rs.war,runtime-name=foo.war)
> [standalone@localhost:9990 /] /deployment=helloworld-rs-second.war:read-resource
> {
> "outcome" => "success",
> "result" => {
> "content" => [{"hash" => bytes {
> 0xfe, 0x24, 0x1f, 0xd3, 0x19, 0xa3, 0x72, 0xd4,
> 0xc6, 0xa4, 0x48, 0xe7, 0x8b, 0x9c, 0xc1, 0xd4,
> 0xc7, 0x17, 0xdf, 0xaa
> }}],
> "enabled" => false,
> "name" => "helloworld-rs-second.war",
> "owner" => undefined,
> "persistent" => true,
> "runtime-name" => "helloworld-rs-second.war",
> "subdeployment" => undefined,
> "subsystem" => {
> "undertow" => undefined,
> "ejb3" => undefined,
> "logging" => undefined
> }
> }
> }
> Foo.war is not applied. Looks like it was ignored.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months
[JBoss JIRA] (WFLY-12375) Server returns 2 JSESSIONID cookies
by Brian Stansberry (Jira)
[ https://issues.jboss.org/browse/WFLY-12375?page=com.atlassian.jira.plugin... ]
Brian Stansberry commented on WFLY-12375:
-----------------------------------------
AIUI the suggested bug here is that the inclusion of a JSESSIONID cookie in the request is resulting in the creation of a session object when one doesn't exist.
> Server returns 2 JSESSIONID cookies
> ------------------------------------
>
> Key: WFLY-12375
> URL: https://issues.jboss.org/browse/WFLY-12375
> Project: WildFly
> Issue Type: Bug
> Components: Web (Undertow)
> Affects Versions: 17.0.1.Final
> Reporter: Nicolas NESMON
> Assignee: Flavia Rainone
> Priority: Major
> Labels: COOKIES, JSESSIONID
>
> Please find below the source code of my simplified JAX-RS application:
> {code:java}
> @ApplicationPath("myApp")
> public class Application extends javax.ws.rs.core.Application {
> public Application() {
> }
> @Override
> public Set<Object> getSingletons() {
> return Collections.singleton(new HelloWorldResource());
> }
> }
> {code}
> {code:java}
> @Path("/")
> @Produces(MediaType.TEXT_PLAIN)
> public class HelloWorldResource {
> @Context
> private HttpServletRequest httpServletRequest;
> @GET
> public Response helloWorld() {
> HttpSession session = this.httpServletRequest.getSession(false);
> return Response.ok(session == null ? "Hello world" : "Bye bye world")
> .cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
> }
> }
> {code}
> When deploying this application in WF 17.0.1.Final and running following request:
> {noformat}
> GET http://localhost:8080/demo/myApp/
> Host: localhost:8080
> User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
> Accept-Encoding: gzip, deflate
> Connection: keep-alive
> Upgrade-Insecure-Requests: 1
> Pragma: no-cache
> Cache-Control: no-cache
> Cookie: JSESSIONID=Hello => without this cookie, I only get the cookie I created.
> {noformat}
> I get following response
> {noformat}
> HTTP/1.1 200 OK
> Connection: keep-alive
> Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
> Set-Cookie: JSESSIONID=hello.vpi070236; path=/demo
> Content-Type: text/plain;charset=UTF-8
> Content-Length: 11
> Date: Tue, 13 Aug 2019 23:28:15 GMT
> {noformat}
> As you may notice, there are 2 JSESSIONID cookies in the response:
> * The one I was expecting with "id" value since I created it.
> * Another one created by the server even if I did not ask for it since in my code I don't create no HTTP session. And by the way this JSESSIONID cookie is created but there no server side session created...weird
> Any idea why this second JSESSIONID cookies is created by the server ?
> Since my real application don't use HTTP session at all the workaround I found is to set session tracking mode to URL:
> {noformat}
> <web-app>
> <session-config>
> <tracking-mode>URL</tracking-mode>
> </session-config>
> </web-app>
> {noformat}
> Thanks
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months
[JBoss JIRA] (WFLY-12375) Server returns 2 JSESSIONID cookies
by Brian Stansberry (Jira)
[ https://issues.jboss.org/browse/WFLY-12375?page=com.atlassian.jira.plugin... ]
Brian Stansberry reassigned WFLY-12375:
---------------------------------------
Component/s: Web (Undertow)
(was: EE)
Assignee: Flavia Rainone (was: Brian Stansberry)
> Server returns 2 JSESSIONID cookies
> ------------------------------------
>
> Key: WFLY-12375
> URL: https://issues.jboss.org/browse/WFLY-12375
> Project: WildFly
> Issue Type: Bug
> Components: Web (Undertow)
> Affects Versions: 17.0.1.Final
> Reporter: Nicolas NESMON
> Assignee: Flavia Rainone
> Priority: Major
> Labels: COOKIES, JSESSIONID
>
> Please find below the source code of my simplified JAX-RS application:
> {code:java}
> @ApplicationPath("myApp")
> public class Application extends javax.ws.rs.core.Application {
> public Application() {
> }
> @Override
> public Set<Object> getSingletons() {
> return Collections.singleton(new HelloWorldResource());
> }
> }
> {code}
> {code:java}
> @Path("/")
> @Produces(MediaType.TEXT_PLAIN)
> public class HelloWorldResource {
> @Context
> private HttpServletRequest httpServletRequest;
> @GET
> public Response helloWorld() {
> HttpSession session = this.httpServletRequest.getSession(false);
> return Response.ok(session == null ? "Hello world" : "Bye bye world")
> .cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
> }
> }
> {code}
> When deploying this application in WF 17.0.1.Final and running following request:
> {noformat}
> GET http://localhost:8080/demo/myApp/
> Host: localhost:8080
> User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
> Accept-Encoding: gzip, deflate
> Connection: keep-alive
> Upgrade-Insecure-Requests: 1
> Pragma: no-cache
> Cache-Control: no-cache
> Cookie: JSESSIONID=Hello => without this cookie, I only get the cookie I created.
> {noformat}
> I get following response
> {noformat}
> HTTP/1.1 200 OK
> Connection: keep-alive
> Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
> Set-Cookie: JSESSIONID=hello.vpi070236; path=/demo
> Content-Type: text/plain;charset=UTF-8
> Content-Length: 11
> Date: Tue, 13 Aug 2019 23:28:15 GMT
> {noformat}
> As you may notice, there are 2 JSESSIONID cookies in the response:
> * The one I was expecting with "id" value since I created it.
> * Another one created by the server even if I did not ask for it since in my code I don't create no HTTP session. And by the way this JSESSIONID cookie is created but there no server side session created...weird
> Any idea why this second JSESSIONID cookies is created by the server ?
> Since my real application don't use HTTP session at all the workaround I found is to set session tracking mode to URL:
> {noformat}
> <web-app>
> <session-config>
> <tracking-mode>URL</tracking-mode>
> </session-config>
> </web-app>
> {noformat}
> Thanks
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months
[JBoss JIRA] (WFLY-12375) Server returns 2 JSESSIONID cookies
by Nicolas NESMON (Jira)
[ https://issues.jboss.org/browse/WFLY-12375?page=com.atlassian.jira.plugin... ]
Nicolas NESMON updated WFLY-12375:
----------------------------------
Issue Type: Bug (was: Enhancement)
> Server returns 2 JSESSIONID cookies
> ------------------------------------
>
> Key: WFLY-12375
> URL: https://issues.jboss.org/browse/WFLY-12375
> Project: WildFly
> Issue Type: Bug
> Components: EE
> Affects Versions: 17.0.1.Final
> Reporter: Nicolas NESMON
> Assignee: Brian Stansberry
> Priority: Major
> Labels: COOKIES, JSESSIONID
>
> Please find below the source code of my simplified JAX-RS application:
> {code:java}
> @ApplicationPath("myApp")
> public class Application extends javax.ws.rs.core.Application {
> public Application() {
> }
> @Override
> public Set<Object> getSingletons() {
> return Collections.singleton(new HelloWorldResource());
> }
> }
> {code}
> {code:java}
> @Path("/")
> @Produces(MediaType.TEXT_PLAIN)
> public class HelloWorldResource {
> @Context
> private HttpServletRequest httpServletRequest;
> @GET
> public Response helloWorld() {
> HttpSession session = this.httpServletRequest.getSession(false);
> return Response.ok(session == null ? "Hello world" : "Bye bye world")
> .cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
> }
> }
> {code}
> When deploying this application in WF 17.0.1.Final and running following request:
> {noformat}
> GET http://localhost:8080/demo/myApp/
> Host: localhost:8080
> User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
> Accept-Encoding: gzip, deflate
> Connection: keep-alive
> Upgrade-Insecure-Requests: 1
> Pragma: no-cache
> Cache-Control: no-cache
> Cookie: JSESSIONID=Hello => without this cookie, I only get the cookie I created.
> {noformat}
> I get following response
> {noformat}
> HTTP/1.1 200 OK
> Connection: keep-alive
> Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
> Set-Cookie: JSESSIONID=hello.vpi070236; path=/demo
> Content-Type: text/plain;charset=UTF-8
> Content-Length: 11
> Date: Tue, 13 Aug 2019 23:28:15 GMT
> {noformat}
> As you may notice, there are 2 JSESSIONID cookies in the response:
> * The one I was expecting with "id" value since I created it.
> * Another one created by the server even if I did not ask for it since in my code I don't create no HTTP session. And by the way this JSESSIONID cookie is created but there no server side session created...weird
> Any idea why this second JSESSIONID cookies is created by the server ?
> Since my real application don't use HTTP session at all the workaround I found is to set session tracking mode to URL:
> {noformat}
> <web-app>
> <session-config>
> <tracking-mode>URL</tracking-mode>
> </session-config>
> </web-app>
> {noformat}
> Thanks
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months