[jboss-jira] [JBoss JIRA] Resolved: (JBWEB-121) Session Cookie Paths
[
https://jira.jboss.org/jira/browse/JBWEB-121?page=com.atlassian.jira.plug...
]
Remy Maucherat resolved JBWEB-121.
----------------------------------
Resolution: Rejected
This switched to configuration defaults and capabilities of the Servlet 3.0 API, and is
using a <SessionCookie path="/"> element inside a <Context> element,
for example in context.xml.
I descibed the situation to the expert group, and the conclusion so far is that default to
the context path is better. I support that, since I think the portlet EG went way over its
head with its abuse of cross context and expectations about session behavior.
Session Cookie Paths
--------------------
Key: JBWEB-121
URL: https://jira.jboss.org/jira/browse/JBWEB-121
Project: JBoss Web
Issue Type: Bug
Security Level: Public(Everyone can see)
Affects Versions: JBossWeb-2.1.1.GA
Reporter: Matt Wringe
Assignee: Remy Maucherat
JBoss Web 2.1.1.CR6 changed the path of the session cookie from being hardcoded to the
root ("/") to that of the webapp's context (see
org.apache.catalina.connector.Request configureSessionCookie).
Normally it would be possible to override this and set the session cookies to always have
a path of "/" by setting emptySessionPath="true" for the connector,
but this is not implemented in JBossWeb (this does of course work fine with upstream
Tomcat).
The big issue here is that having an empty session path for session cookies is a
requirement for portals, and since JBoss AS5 will be using this version it means that
JBoss Portal (and any other portals) will not work with it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira