How can I ensure that a new login gets a unique HttpSession?

[Darren Lee <da...@gmail.com>]

I have a Tapestry application that requires the user to log in before
doing anything.  The login process looks much like the example in the
VLib application.  After the user's credentials are checked, the login
page calls getVisit() which forces the application to go stateful by
creating an HttpSession.  During the course of the user's session,
various pieces of information are stored in the session.

Some power users of our application occasionally create multiple,
simultaneous, logins to the application as different application users
(each in its own browser window).  This works fine because the cookies
created by the servlet engine are in-memory cookies and thus distinct
for each instance of the browser.

In one scenario, however, this breaks down:
1)	User logs into the application using IE
2)	User hits Ctrl-N to create a new browser window so he/she can have
2 simultaneous logins to the application as 2 different users. 
Without logging out, the user navigates to the login page in the new
window and logs in as a different user
3)	IE sends the *same* jsession cookie along with the login form
submit.  Tapestry reuses the session and now the session is shared
between the 2 browser instances.  A user's activity in one browser
window corrupts the work in the second window!

To rectify this situation, I would like the login form handler to
examine the session and see if it is new (by calling session.isNew())
and if it is not, somehow invalidate the session, create a new one,
and continue.  I cannot  figure out how to do this using the
RequestContext and Engine methods.

Any advice on how to achieve this?

Thanks,
Darren

---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org