[jboss-jira] [JBoss JIRA] Resolved: (JBWEB-121) Session Cookie Paths

Wed Sep 17 17:01:20 EDT 2008

     [ https://jira.jboss.org/jira/browse/JBWEB-121?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Remy Maucherat resolved JBWEB-121.
----------------------------------

    Resolution: Rejected

This switched to configuration defaults and capabilities of the Servlet 3.0 API, and is using a <SessionCookie path="/"> element inside a <Context> element, for example in context.xml.

I descibed the situation to the expert group, and the conclusion so far is that default to the context path is better. I support that, since I think the portlet EG went way over its head with its abuse of cross context and expectations about session behavior.

> Session Cookie Paths
> --------------------
>
>                 Key: JBWEB-121
>                 URL: https://jira.jboss.org/jira/browse/JBWEB-121
>             Project: JBoss Web
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>    Affects Versions: JBossWeb-2.1.1.GA
>            Reporter: Matt Wringe
>            Assignee: Remy Maucherat
>
> JBoss Web 2.1.1.CR6 changed the path of the session cookie from being hardcoded to the root ("/") to that of the webapp's context (see org.apache.catalina.connector.Request configureSessionCookie).
> Normally it would be possible to override this and set the session cookies to always have a path of "/" by setting emptySessionPath="true" for the connector, but this is not implemented in JBossWeb (this does of course work fine with upstream Tomcat).
> The big issue here is that having an empty session path for session cookies is a requirement for portals, and since JBoss AS5 will be using this version it means that JBoss Portal (and any other portals) will not work with it.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira