[jboss-jira] [JBoss JIRA] Commented: (JBWEB-153) Parent context cookie overwriting URL encoded cookie

[Mike Millson (JIRA)]

    [ https://jira.jboss.org/jira/browse/JBWEB-153?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12498354#action_12498354 ] 

Mike Millson commented on JBWEB-153:
------------------------------------

Test case:
1) Set up instance #1 of JBoss listening on port 8080 with cookies="true" in JBOSS_HOME/server/SERVERCONF/deploy/JBOSSWEB/context.xml (this this the default configuration).
2) Set up instance #2 of JBoss listening on port 8090 with cookies="false" in JBOSS_HOME/server/SERVERCONF/deploy/JBOSSWEB/context.xml.
3) Deploy the attached testbox.war into both instances.
4) Access the URL rewriting test on each instance:
curl -L -D headers.txt --cookie JSESSIONID=AAA http://localhost:8180/testbox/servlet/UrlRewriting
curl -L -D headers.txt --cookie JSESSIONID=AAA http://localhost:8280/testbox/servlet/UrlRewriting

Before the fix both requests will return this result::
<p>Hits: 1</p>
<p><a href="/testbox/servlet/UrlRewriting">Hit it</a>

After the fix instance #2 will return a result with the url rewriting in the link. for example:
<p>Hits: 1</p>
<p><a href="/testbox/servlet/UrlRewriting;jsessionid=9A946FADF161144321BB2A559D28BAD8">Hit it</a>



> Parent context cookie overwriting URL encoded cookie
> ----------------------------------------------------
>
>                 Key: JBWEB-153
>                 URL: https://jira.jboss.org/jira/browse/JBWEB-153
>             Project: JBoss Web
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: Core
>    Affects Versions: JBossWeb-2.0.0.GA_CP06, JBossWeb-2.1.3.GA
>            Reporter: Mike Millson
>            Assignee: Mike Millson
>
> When cookies are disabled for the context, a session cookie from a parent context will overwrite the session ID encoded in the URL.
> Reference:
> https://issues.apache.org/bugzilla/show_bug.cgi?id=43839

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira