[jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-3018) Tomcat appending jsessionid to URLs breaks page fragment cache

[Christian Bauer (JIRA)]

    [ http://jira.jboss.com/jira/browse/JBSEAM-3018?page=comments#action_12413517 ] 
            
Christian Bauer commented on JBSEAM-3018:
-----------------------------------------

Workaround is this filter:

@Startup
@Scope(ScopeType.APPLICATION)
@Name("wikiUrlSessionIdFilter")
@BypassInterceptors
@Filter
public class WikiUrlSessionIdFilter extends AbstractFilter {

    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {

        if (!(req instanceof HttpServletRequest)) {
            chain.doFilter(req, res);
            return;
        }

        HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;

        // Redirect requests with JSESSIONID in URL to clean version (old links bookmarked/stored by bots)
        // This is ONLY triggered if the request did not also contain a JSESSIONID cookie! Which should be fine for bots...
        if (request.isRequestedSessionIdFromURL()) {
            response.sendError(
                HttpServletResponse.SC_MOVED_PERMANENTLY,
                request.getRequestURL().append("?").append(request.getQueryString()).toString()
            );
            return;
        }

        // Prevent rendering of JSESSIONID in URLs for all outgoing links
        HttpServletResponseWrapper wrappedResponse =
            new HttpServletResponseWrapper(response) {
                @Override
                public String encodeRedirectUrl(String url) {
                    return url;
                }

                @Override
                public String encodeRedirectURL(String url) {
                    return url;
                }

                @Override
                public String encodeUrl(String url) {
                    return url;
                }

                @Override
                public String encodeURL(String url) {
                    return url;
                }
            };
        chain.doFilter(req, wrappedResponse);

    }
}

This effectively disables URL rewriting. That also means the site no longer works without cookies, so for a good user experience, an additional cookie check is needed.



> Tomcat appending jsessionid to URLs breaks page fragment cache
> --------------------------------------------------------------
>
>                 Key: JBSEAM-3018
>                 URL: http://jira.jboss.com/jira/browse/JBSEAM-3018
>             Project: Seam
>          Issue Type: Task
>          Components: JSF Integration
>            Reporter: Christian Bauer
>            Priority: Critical
>
> Tomcat/JSF encodes URLs and, even if cookies are enabled, sometimes appends a JSESSIONID parameter. If you request a page fragment, your session id is encoded into the rendered URLs. If I then later retrieve that fragment from the cache, I get your session. This is a critical issue, I'll look for a workaround, if that's not possible, we need to document it.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira