[JBoss JIRA] (WFLY-12376) wildfly-ejb-client-bom does not manage org.jboss.ejb3:jboss-ejb3-ext-api anymore
by Eduardo Martins (Jira)
[ https://issues.jboss.org/browse/WFLY-12376?page=com.atlassian.jira.plugin... ]
Eduardo Martins moved JBEAP-17394 to WFLY-12376:
------------------------------------------------
Project: WildFly (was: JBoss Enterprise Application Platform)
Key: WFLY-12376 (was: JBEAP-17394)
Workflow: GIT Pull Request workflow (was: CDW with loose statuses v1)
Component/s: BOM
(was: BOM)
Affects Version/s: 17.0.1.Final
(was: 7.3.0.CD17)
> wildfly-ejb-client-bom does not manage org.jboss.ejb3:jboss-ejb3-ext-api anymore
> --------------------------------------------------------------------------------
>
> Key: WFLY-12376
> URL: https://issues.jboss.org/browse/WFLY-12376
> Project: WildFly
> Issue Type: Bug
> Components: BOM
> Affects Versions: 17.0.1.Final
> Reporter: Eduardo Martins
> Assignee: Eduardo Martins
> Priority: Blocker
>
> When using {{org.jboss.eap:wildfly-ejb-client-bom:7.3.0.CD17}}, {{org.jboss.ejb3:jboss-ejb3-ext-api}} is not provided anymore. This is a regression compared to {{org.jboss.eap:wildfly-ejb-client-bom:7.3.0.CD16}}.
> From the user point of view, this will mean they will have to modify their existing applications to include version of this dependency, which is pretty bad UX.
> The BOM is the only recommended and documented way to consume EJB client libraries in standalone applications, please see [Developing EJB Applications|https://access.redhat.com/documentation/en-us/red_hat_jboss_...].
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months
[JBoss JIRA] (JGRP-2368) Deprecate AUTH tokens
by Bela Ban (Jira)
Bela Ban created JGRP-2368:
------------------------------
Summary: Deprecate AUTH tokens
Key: JGRP-2368
URL: https://issues.jboss.org/browse/JGRP-2368
Project: JGroups
Issue Type: Task
Reporter: Bela Ban
Assignee: Bela Ban
Fix For: 4.1.3
* Deprecate AuthTokens that are not needed anymore (replaced by SSL_KEY_EXCHANGE and ASYM_ENCRYPT)
* Update documentation
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months
[JBoss JIRA] (JGRP-2273) ASYM_ENCRYPT: deprecate encrypt_entire_message
by Bela Ban (Jira)
[ https://issues.jboss.org/browse/JGRP-2273?page=com.atlassian.jira.plugin.... ]
Bela Ban commented on JGRP-2273:
--------------------------------
[~nsawadsky] Yes, an attacker would be able to do a replay attack. However, UNICAST3 would drop that message as duplicate. This doesn't prevent seqno guessing, e.g. as done in [1].
[1] https://github.com/belaban/JGroups/blob/master/tests/junit-functional/org...
> ASYM_ENCRYPT: deprecate encrypt_entire_message
> ----------------------------------------------
>
> Key: JGRP-2273
> URL: https://issues.jboss.org/browse/JGRP-2273
> Project: JGroups
> Issue Type: Enhancement
> Reporter: Bela Ban
> Assignee: Bela Ban
> Priority: Major
> Fix For: 4.1.3
>
>
> In {{ASYM_ENCRYPT}}, {{encrypt_entire_message}} encrypts not only the payload, but also metadata such as destination and sender's address, headers and flags.
> The rationale was to prevent replay attacks. However, this is not an issue, as replayed messages will simply get dropped by the retransmission layer (e.g. NAKACK2 or UNICAST3).
> If people still want this feature, they can write a protocol _above_ {{ASYM_ENCRYPT}}, which serializes the entire message into the payload of a new message, and this would be exactly the same as setting {{encrypt_entire_message}} to {{true}}.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months
[JBoss JIRA] (DROOLS-4431) DMN REST endpoint requires stateful kie session
by Justin Jarae (Jira)
[ https://issues.jboss.org/browse/DROOLS-4431?page=com.atlassian.jira.plugi... ]
Justin Jarae updated DROOLS-4431:
---------------------------------
Labels: field (was: )
> DMN REST endpoint requires stateful kie session
> -----------------------------------------------
>
> Key: DROOLS-4431
> URL: https://issues.jboss.org/browse/DROOLS-4431
> Project: Drools
> Issue Type: Bug
> Environment: Noticed this is RHDM 7.3. Still exists in 7.4. Don't know which versions of Drools that coincides with.
> Reporter: Justin Jarae
> Assignee: Mario Fusco
> Priority: Major
> Labels: field
> Attachments: DMN-Test.zip
>
>
> When trying to run DMN via the rest endpoint, if the default KIE session is stateless, an error is returned stating that "Cannot find a default KieSession". If the stateful session is specified as default, the DMN execution works as expected. This forces you to specify stateless for all other requests.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months
[JBoss JIRA] (WFCORE-4605) Test applying legacy one-off patches to Galleon-slimmed installations
by Brian Stansberry (Jira)
Brian Stansberry created WFCORE-4605:
----------------------------------------
Summary: Test applying legacy one-off patches to Galleon-slimmed installations
Key: WFCORE-4605
URL: https://issues.jboss.org/browse/WFCORE-4605
Project: WildFly Core
Issue Type: Task
Components: Patching
Reporter: Brian Stansberry
Assignee: Brian Stansberry
An installation that has been slimmed by Galleon should still be able to handle one-off patches provided by the legacy patching tool, so long as the necessary management layers are present and the org.jboss.as.patching[.cli] packages are present.
Task is to add tests confirming this.
My plan is to provision such an installation in testsuite/patching and then add a surefire execution that runs BasicOneOffPatchingScenariosTestCase against that installation.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months
[JBoss JIRA] (WFLY-12375) Server returns 2 JSESSIONID cookies
by Nicolas NESMON (Jira)
[ https://issues.jboss.org/browse/WFLY-12375?page=com.atlassian.jira.plugin... ]
Nicolas NESMON updated WFLY-12375:
----------------------------------
Description:
Please find below the source code of my simplified JAX-RS application:
{code:java}
@ApplicationPath("myApp")
public class Application extends javax.ws.rs.core.Application {
public Application() {
}
@Override
public Set<Object> getSingletons() {
return Collections.singleton(new HelloWorldResource());
}
}
{code}
{code:java}
@Path("/")
@Produces(MediaType.TEXT_PLAIN)
public class HelloWorldResource {
@Context
private HttpServletRequest httpServletRequest;
@GET
public Response helloWorld() {
HttpSession session = this.httpServletRequest.getSession(false);
return Response.ok(session == null ? "Hello world" : "Bye bye world")
.cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
}
}
{code}
When deploying this application in WF 17.0.1.Final and running following request:
{noformat}
GET http://localhost:8080/demo/myApp/
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
Cookie: JSESSIONID=Hello => without this cookie, I only get the cookie I created.
{noformat}
I get following response
{noformat}
HTTP/1.1 200 OK
Connection: keep-alive
Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
Set-Cookie: JSESSIONID=hello.vpi070236; path=/demo
Content-Type: text/plain;charset=UTF-8
Content-Length: 11
Date: Tue, 13 Aug 2019 23:28:15 GMT
{noformat}
As you may notice, there are 2 JSESSIONID cookies in the response:
* The one I was expecting with "id" value since I created it.
* Another one created by the server even if I did not ask for it since in my code I don't create no HTTP session. And by the way this JSESSIONID cookie is created but there no server side session created...weird
Any idea why this second JSESSIONID cookies is created by the server ?
Since my real application don't use HTTP session at all the workaround I found is to set session tracking mode to URL:
{noformat}
<web-app>
<session-config>
<tracking-mode>URL</tracking-mode>
</session-config>
</web-app>
{noformat}
Thanks
was:
Please find below the source code of my simple JAX-RS application:
{code:java}
@ApplicationPath("myApp")
public class Application extends javax.ws.rs.core.Application {
public Application() {
}
@Override
public Set<Object> getSingletons() {
return Collections.singleton(new HelloWorldResource());
}
}
{code}
{code:java}
@Path("/")
@Produces(MediaType.TEXT_PLAIN)
public class HelloWorldResource {
@Context
private HttpServletRequest httpServletRequest;
@GET
public Response helloWorld() {
HttpSession session = this.httpServletRequest.getSession(false);
return Response.ok(session == null ? "Hello world" : "Bye bye world")
.cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
}
}
{code}
When deploying this application in WF 17.0.1.Final and running following request:
{noformat}
GET http://localhost:8080/demo/myApp/
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
Cookie: JSESSIONID=Hello => without this cookie, I only get the cookie I created.
{noformat}
I get following response
{noformat}
HTTP/1.1 200 OK
Connection: keep-alive
Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
Set-Cookie: JSESSIONID=hello.vpi070236; path=/demo
Content-Type: text/plain;charset=UTF-8
Content-Length: 11
Date: Tue, 13 Aug 2019 23:28:15 GMT
{noformat}
As you may notice, there are 2 JSESSIONID cookies in the response:
* The one I was expecting with "id" value since I created it.
* Another own created by the server even if I did not ask for it since in my code I don't create no HTTP session.
Any idea why this second JSESIONID cookies is created by the server ?
Thanks
> Server returns 2 JSESSIONID cookies
> ------------------------------------
>
> Key: WFLY-12375
> URL: https://issues.jboss.org/browse/WFLY-12375
> Project: WildFly
> Issue Type: Enhancement
> Components: EE
> Affects Versions: 17.0.1.Final
> Reporter: Nicolas NESMON
> Assignee: Brian Stansberry
> Priority: Major
> Labels: COOKIES, JSESSIONID
>
> Please find below the source code of my simplified JAX-RS application:
> {code:java}
> @ApplicationPath("myApp")
> public class Application extends javax.ws.rs.core.Application {
> public Application() {
> }
> @Override
> public Set<Object> getSingletons() {
> return Collections.singleton(new HelloWorldResource());
> }
> }
> {code}
> {code:java}
> @Path("/")
> @Produces(MediaType.TEXT_PLAIN)
> public class HelloWorldResource {
> @Context
> private HttpServletRequest httpServletRequest;
> @GET
> public Response helloWorld() {
> HttpSession session = this.httpServletRequest.getSession(false);
> return Response.ok(session == null ? "Hello world" : "Bye bye world")
> .cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
> }
> }
> {code}
> When deploying this application in WF 17.0.1.Final and running following request:
> {noformat}
> GET http://localhost:8080/demo/myApp/
> Host: localhost:8080
> User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
> Accept-Encoding: gzip, deflate
> Connection: keep-alive
> Upgrade-Insecure-Requests: 1
> Pragma: no-cache
> Cache-Control: no-cache
> Cookie: JSESSIONID=Hello => without this cookie, I only get the cookie I created.
> {noformat}
> I get following response
> {noformat}
> HTTP/1.1 200 OK
> Connection: keep-alive
> Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
> Set-Cookie: JSESSIONID=hello.vpi070236; path=/demo
> Content-Type: text/plain;charset=UTF-8
> Content-Length: 11
> Date: Tue, 13 Aug 2019 23:28:15 GMT
> {noformat}
> As you may notice, there are 2 JSESSIONID cookies in the response:
> * The one I was expecting with "id" value since I created it.
> * Another one created by the server even if I did not ask for it since in my code I don't create no HTTP session. And by the way this JSESSIONID cookie is created but there no server side session created...weird
> Any idea why this second JSESSIONID cookies is created by the server ?
> Since my real application don't use HTTP session at all the workaround I found is to set session tracking mode to URL:
> {noformat}
> <web-app>
> <session-config>
> <tracking-mode>URL</tracking-mode>
> </session-config>
> </web-app>
> {noformat}
> Thanks
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months
[JBoss JIRA] (WFLY-12375) Server returns 2 JSESSIONID cookies
by Nicolas NESMON (Jira)
[ https://issues.jboss.org/browse/WFLY-12375?page=com.atlassian.jira.plugin... ]
Nicolas NESMON updated WFLY-12375:
----------------------------------
Description:
Please find below the source code of my simple JAX-RS application:
{code:java}
@ApplicationPath("myApp")
public class Application extends javax.ws.rs.core.Application {
public Application() {
}
@Override
public Set<Object> getSingletons() {
return Collections.singleton(new HelloWorldResource());
}
}
{code}
{code:java}
@Path("/")
@Produces(MediaType.TEXT_PLAIN)
public class HelloWorldResource {
@Context
private HttpServletRequest httpServletRequest;
@GET
public Response helloWorld() {
HttpSession session = this.httpServletRequest.getSession(false);
return Response.ok(session == null ? "Hello world" : "Bye bye world")
.cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
}
}
{code}
When deploying this application in WF 17.0.1.Final and running following request:
{noformat}
GET http://localhost:8080/demo/myApp/
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
Cookie: JSESSIONID=Hello => without this cookie, I only get the cookie I created.
{noformat}
I get following response
{noformat}
HTTP/1.1 200 OK
Connection: keep-alive
Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
Set-Cookie: JSESSIONID=hello.vpi070236; path=/demo
Content-Type: text/plain;charset=UTF-8
Content-Length: 11
Date: Tue, 13 Aug 2019 23:28:15 GMT
{noformat}
As you may notice, there are 2 JSESSIONID cookies in the response:
* The one I was expecting with "id" value since I created it.
* Another own created by the server even if I did not ask for it since in my code I don't create no HTTP session.
Any idea why this second JSESIONID cookies is created by the server ?
Thanks
was:
Please find below the source code of my simple JAX-RS application:
{code:java}
@ApplicationPath("myApp")
public class Application extends javax.ws.rs.core.Application {
public Application() {
}
@Override
public Set<Object> getSingletons() {
return Collections.singleton(new HelloWorldResource());
}
}
{code}
{code:java}
@Path("/")
@Produces(MediaType.TEXT_PLAIN)
public class HelloWorldResource {
@Context
private HttpServletRequest httpServletRequest;
@GET
public Response helloWorld() {
HttpSession session = this.httpServletRequest.getSession(false);
return Response.ok(session == null ? "Hello world" : "Bye bye world")
.cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
}
}
{code}
When deploying this application in WF 17.0.1.Final and running following request:
{noformat}
GET http://localhost:8080/demo/myApp/
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
Cookie: JSESSIONID=Hello => without this I only get the cookie I created
{noformat}
I get following response
{noformat}
HTTP/1.1 200 OK
Connection: keep-alive
Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
Set-Cookie: JSESSIONID=hello.vpi070236; path=/demo
Content-Type: text/plain;charset=UTF-8
Content-Length: 11
Date: Tue, 13 Aug 2019 23:28:15 GMT
{noformat}
As you may notice, there are 2 JSESSIONID cookies in the response:
* The one I was expecting with "id" value since I created it.
* Another own created by the server even if I did not ask for it since in my code I don't create no HTTP session.
Any idea why this second JSESIONID cookies is created by the server ?
Thanks
> Server returns 2 JSESSIONID cookies
> ------------------------------------
>
> Key: WFLY-12375
> URL: https://issues.jboss.org/browse/WFLY-12375
> Project: WildFly
> Issue Type: Enhancement
> Components: EE
> Affects Versions: 17.0.1.Final
> Reporter: Nicolas NESMON
> Assignee: Brian Stansberry
> Priority: Major
> Labels: COOKIES, JSESSIONID
>
> Please find below the source code of my simple JAX-RS application:
> {code:java}
> @ApplicationPath("myApp")
> public class Application extends javax.ws.rs.core.Application {
> public Application() {
> }
> @Override
> public Set<Object> getSingletons() {
> return Collections.singleton(new HelloWorldResource());
> }
> }
> {code}
> {code:java}
> @Path("/")
> @Produces(MediaType.TEXT_PLAIN)
> public class HelloWorldResource {
> @Context
> private HttpServletRequest httpServletRequest;
> @GET
> public Response helloWorld() {
> HttpSession session = this.httpServletRequest.getSession(false);
> return Response.ok(session == null ? "Hello world" : "Bye bye world")
> .cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
> }
> }
> {code}
> When deploying this application in WF 17.0.1.Final and running following request:
> {noformat}
> GET http://localhost:8080/demo/myApp/
> Host: localhost:8080
> User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
> Accept-Encoding: gzip, deflate
> Connection: keep-alive
> Upgrade-Insecure-Requests: 1
> Pragma: no-cache
> Cache-Control: no-cache
> Cookie: JSESSIONID=Hello => without this cookie, I only get the cookie I created.
> {noformat}
> I get following response
> {noformat}
> HTTP/1.1 200 OK
> Connection: keep-alive
> Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
> Set-Cookie: JSESSIONID=hello.vpi070236; path=/demo
> Content-Type: text/plain;charset=UTF-8
> Content-Length: 11
> Date: Tue, 13 Aug 2019 23:28:15 GMT
> {noformat}
> As you may notice, there are 2 JSESSIONID cookies in the response:
> * The one I was expecting with "id" value since I created it.
> * Another own created by the server even if I did not ask for it since in my code I don't create no HTTP session.
> Any idea why this second JSESIONID cookies is created by the server ?
> Thanks
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months
[JBoss JIRA] (WFLY-12375) Server returns 2 JSESSIONID cookies
by Nicolas NESMON (Jira)
[ https://issues.jboss.org/browse/WFLY-12375?page=com.atlassian.jira.plugin... ]
Nicolas NESMON updated WFLY-12375:
----------------------------------
Description:
Please find below the source code of my simple JAX-RS application:
{code:java}
@ApplicationPath("myApp")
public class Application extends javax.ws.rs.core.Application {
public Application() {
}
@Override
public Set<Object> getSingletons() {
return Collections.singleton(new HelloWorldResource());
}
}
{code}
{code:java}
@Path("/")
@Produces(MediaType.TEXT_PLAIN)
public class HelloWorldResource {
@Context
private HttpServletRequest httpServletRequest;
@GET
public Response helloWorld() {
HttpSession session = this.httpServletRequest.getSession(false);
return Response.ok(session == null ? "Hello world" : "Bye bye world")
.cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
}
}
{code}
When deploying this application in WF 17.0.1.Final and running following request:
{noformat}
GET http://localhost:8080/demo/myApp/
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
Cookie: JSESSIONID=Hello => without this I only get the cookie I created
{noformat}
I get following response
{noformat}
HTTP/1.1 200 OK
Connection: keep-alive
Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
Set-Cookie: JSESSIONID=hello.vpi070236; path=/demo
Content-Type: text/plain;charset=UTF-8
Content-Length: 11
Date: Tue, 13 Aug 2019 23:28:15 GMT
{noformat}
As you may notice, there are 2 JSESSIONID cookies in the response:
* The one I was expecting with "id" value since I created it.
* Another own created by the server even if I did not ask for it since in my code I don't create no HTTP session.
Any idea why this second JSESIONID cookies is created by the server ?
Thanks
was:
Please find below the source code of my simple JAX-RS application:
{code:java}
@ApplicationPath("myApp")
public class Application extends javax.ws.rs.core.Application {
public Application() {
}
@Override
public Set<Object> getSingletons() {
return Collections.singleton(new HelloWorldResource());
}
}
{code}
{code:java}
@Path("/")
@Produces(MediaType.TEXT_PLAIN)
public class HelloWorldResource {
@Context
private HttpServletRequest httpServletRequest;
@GET
public Response helloWorld() {
HttpSession session = this.httpServletRequest.getSession(false);
return Response.ok(session == null ? "Hello world" : "Bye bye world")
.cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
}
}
{code}
When deploying this application in WF 17.0.1.Final and running following request:
{noformat}
GET http://localhost:8080/demo/myApp/
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
Cookie: JSESSIONID=Hello => without this I only get the cookie I created
{noformat}
I get following response
{noformat}
HTTP/1.1 200 OK
Connection: keep-alive
Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
Set-Cookie: JSESSIONID=hello.vdw070137; path=/demo
Content-Type: text/plain;charset=UTF-8
Content-Length: 11
Date: Tue, 13 Aug 2019 23:28:15 GMT
{noformat}
As you may notice, there are 2 JSESSIONID cookies in the response:
* The one I was expecting with "id" value since I created it.
* Another own created by the server even if I did not ask for it since in my code I don't create no HTTP session.
Any idea why this second JSESIONID cookies is created by the server ?
Thanks
> Server returns 2 JSESSIONID cookies
> ------------------------------------
>
> Key: WFLY-12375
> URL: https://issues.jboss.org/browse/WFLY-12375
> Project: WildFly
> Issue Type: Enhancement
> Components: EE
> Affects Versions: 17.0.1.Final
> Reporter: Nicolas NESMON
> Assignee: Brian Stansberry
> Priority: Major
> Labels: COOKIES, JSESSIONID
>
> Please find below the source code of my simple JAX-RS application:
> {code:java}
> @ApplicationPath("myApp")
> public class Application extends javax.ws.rs.core.Application {
> public Application() {
> }
> @Override
> public Set<Object> getSingletons() {
> return Collections.singleton(new HelloWorldResource());
> }
> }
> {code}
> {code:java}
> @Path("/")
> @Produces(MediaType.TEXT_PLAIN)
> public class HelloWorldResource {
> @Context
> private HttpServletRequest httpServletRequest;
> @GET
> public Response helloWorld() {
> HttpSession session = this.httpServletRequest.getSession(false);
> return Response.ok(session == null ? "Hello world" : "Bye bye world")
> .cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
> }
> }
> {code}
> When deploying this application in WF 17.0.1.Final and running following request:
> {noformat}
> GET http://localhost:8080/demo/myApp/
> Host: localhost:8080
> User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
> Accept-Encoding: gzip, deflate
> Connection: keep-alive
> Upgrade-Insecure-Requests: 1
> Pragma: no-cache
> Cache-Control: no-cache
> Cookie: JSESSIONID=Hello => without this I only get the cookie I created
> {noformat}
> I get following response
> {noformat}
> HTTP/1.1 200 OK
> Connection: keep-alive
> Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
> Set-Cookie: JSESSIONID=hello.vpi070236; path=/demo
> Content-Type: text/plain;charset=UTF-8
> Content-Length: 11
> Date: Tue, 13 Aug 2019 23:28:15 GMT
> {noformat}
> As you may notice, there are 2 JSESSIONID cookies in the response:
> * The one I was expecting with "id" value since I created it.
> * Another own created by the server even if I did not ask for it since in my code I don't create no HTTP session.
> Any idea why this second JSESIONID cookies is created by the server ?
> Thanks
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months
[JBoss JIRA] (WFLY-12375) Server returns 2 JSESSIONID cookies
by Nicolas NESMON (Jira)
Nicolas NESMON created WFLY-12375:
-------------------------------------
Summary: Server returns 2 JSESSIONID cookies
Key: WFLY-12375
URL: https://issues.jboss.org/browse/WFLY-12375
Project: WildFly
Issue Type: Enhancement
Components: EE
Affects Versions: 17.0.1.Final
Reporter: Nicolas NESMON
Assignee: Brian Stansberry
Please find below the source code of my simple JAX-RS application:
{code:java}
@ApplicationPath("myApp")
public class Application extends javax.ws.rs.core.Application {
public Application() {
}
@Override
public Set<Object> getSingletons() {
return Collections.singleton(new HelloWorldResource());
}
}
{code}
{code:java}
@Path("/")
@Produces(MediaType.TEXT_PLAIN)
public class HelloWorldResource {
@Context
private HttpServletRequest httpServletRequest;
@GET
public Response helloWorld() {
HttpSession session = this.httpServletRequest.getSession(false);
return Response.ok(session == null ? "Hello world" : "Bye bye world")
.cookie(new NewCookie("JSESSIONID", "id", "demo", null, null, -1, false)).build();
}
}
{code}
When deploying this application in WF 17.0.1.Final and running following request:
{noformat}
GET http://localhost:8080/demo/myApp/
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
Cookie: JSESSIONID=Hello => without this I only get the cookie I created
{noformat}
I get following response
{noformat}
HTTP/1.1 200 OK
Connection: keep-alive
Set-Cookie: JSESSIONID=id;Version=1;Path=/demo
Set-Cookie: JSESSIONID=hello.vdw070137; path=/demo
Content-Type: text/plain;charset=UTF-8
Content-Length: 11
Date: Tue, 13 Aug 2019 23:28:15 GMT
{noformat}
As you may notice, there are 2 JSESSIONID cookies in the response:
* The one I was expecting with "id" value since I created it.
* Another own created by the server even if I did not ask for it since in my code I don't create no HTTP session.
Any idea why this second JSESIONID cookies is created by the server ?
Thanks
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 11 months