[ https://issues.jboss.org/browse/AS7-4623?page=com.atlassian.jira.plugin.s... ] Brian Stansberry reassigned AS7-4623: ------------------------------------- Assignee: Jason Greene (was: Brian Stansberry) Assigning to Jason as he's the expert on all the browser manipulation going on here. The linked pull request is merged. To answer the question, no, there's no plan to implement server-side session management for the console or HTTP management API. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://issues.jboss.org/browse/AS7-4623?page=com.atlassian.jira.plugin.s... ] Jason Greene updated AS7-4623: ------------------------------ Comment: was deleted (was: See the comments in the lower portion of the source. The user/pass used is purposefully bogus, and is designed to pop up the auth box. Although 2 mechanisms are used which trigger firefox to do the same.) -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://issues.jboss.org/browse/AS7-4623?page=com.atlassian.jira.plugin.s... ] Jason Greene commented on AS7-4623: ----------------------------------- See the comments in the lower portion of the source. The user/pass used is purposefully bogus, and is designed to pop up the auth box. Although 2 mechanisms are used which trigger firefox to do the same. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://issues.jboss.org/browse/AS7-4623?page=com.atlassian.jira.plugin.s... ] Jason Greene resolved AS7-4623. ------------------------------- Resolution: Done -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://issues.jboss.org/browse/AS7-4623?page=com.atlassian.jira.plugin.s... ] Jess Sightler commented on AS7-4623: ------------------------------------ @Jason Greene - That isn't really what the username/password do from what I can tell. The Password box in question ends up appearing on the /logout url itself. Entering a valid password fails, entering an invalid one succeeds. As far as I can tell, the intended workflow is: 1. User is redirected to /logout (with a Referer header) 2. /logout parses the referer header and then redirects to (eg: https://enter-login-here:blah@serverip/logout?logout 3. Hopefully the browser accepts "enter-login-here" and "blah" and forwards these to the server 4. /logout redirects back to the referer url AFAICT, in Firefox the "enter-login-here:blah" credentials are lost. Hitting escape on the dialog popup usually works, but seems to be fragile to intermediate proxies (mod_proxy with SSL on the apache side). -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://issues.jboss.org/browse/AS7-4623?page=com.atlassian.jira.plugin.s... ] Jason Greene commented on AS7-4623: ----------------------------------- What darren is referring to is that form auth requires sending passwords in the clear, so without SSL by default (which we dont do out of the box since that requires certs be configured), then our out of the box mechanism would be sending passwords in the clear the second they change the management bind address to a public interface. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira