You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by Albert Kam <mo...@gmail.com> on 2013/11/14 13:49:47 UTC
Removing ;JSESSIONID=xxx from the url after login ?
Hello, i'm currently using the latest stable version of Apache Shiro.
Everything has been working fine, until i want to remove ;JSESSIONID=xxx
from the url after successful login.
I tried suggestion here, by creating a filter that is making use of a
wrappedResponse, and register it into my web.xml, but still failing.
Has anyone here successfully done this before ?
Thank you,
Albert Kam
--
Do not pursue the past. Do not lose yourself in the future.
The past no longer is. The future has not yet come.
Looking deeply at life as it is in the very here and now,
the practitioner dwells in stability and freedom.
(Thich Nhat Hanh)
Re: Removing ;JSESSIONID=xxx from the url after login ?
Posted by Albert Kam <mo...@gmail.com>.
No, i have not got it working people :)
But i think it has something to do with these 2 tickets ?
- https://issues.apache.org/jira/browse/SHIRO-360
- https://issues.apache.org/jira/browse/SHIRO-361
I'm not sure whether this is a Shiro issue or a Tomcat issue though.
Or perhaps it's a servlet specification that dictates the first URL after
login must have a JSESSIONID appended ?
Can anyone elaborate this issue ?
Thank you,
Albert Kam
On Fri, Nov 15, 2013 at 2:36 PM, versatec <ro...@versatec.de> wrote:
> It happens on glassfish, too, not only on tomcat, and I would love to see a
> fix or workaround myself.
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Removing-JSESSIONID-xxx-from-the-url-after-login-tp7579370p7579379.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>
--
Do not pursue the past. Do not lose yourself in the future.
The past no longer is. The future has not yet come.
Looking deeply at life as it is in the very here and now,
the practitioner dwells in stability and freedom.
(Thich Nhat Hanh)
Re: Removing ;JSESSIONID=xxx from the url after login ?
Posted by versatec <ro...@versatec.de>.
It happens on glassfish, too, not only on tomcat, and I would love to see a
fix or workaround myself.
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Removing-JSESSIONID-xxx-from-the-url-after-login-tp7579370p7579379.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Removing ;JSESSIONID=xxx from the url after login ?
Posted by Albert Kam <mo...@gmail.com>.
Since my intention is to prevent the user accidentally sharing the url
containing his JSESSIONID url to public,
I did this simple solution :
- Using a filter, applying only to / (not /*)
- Checks for ;JSESSIONID= existence in the url (happens only after login)
- Redirects to /
Here's the simplest code :
public class JsessionIdAvoiderFilter implements Filter {
@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain
chain) throws IOException, ServletException {
boolean allowFilterChain = redirectToAvoidJsessionId((HttpServletRequest)
req, (HttpServletResponse) res);
// if its redirected, then no need to continue processing the request
if (allowFilterChain) {
chain.doFilter(req, res);
}
}
public static boolean redirectToAvoidJsessionId(HttpServletRequest req,
HttpServletResponse res) {
String requestURI = req.getRequestURI();
if (requestURI.indexOf(";JSESSIONID=") > 0) {
try {
res.sendRedirect("/");
return false;
} catch (IOException e) {
e.printStackTrace();
}
}
return true;
}
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void destroy() {
}
}
<filter>
<display-name>JsessionId Filter</display-name>
<filter-name>jsessionIdAvoiderFilter</filter-name>
<filter-class>web.JsessionIdAvoiderFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>jsessionIdAvoiderFilter</filter-name>
<url-pattern>/</url-pattern>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
So far it's been working great for me here.
Warm regards from Jakarta,
Bertie
On Mon, Nov 18, 2013 at 11:33 PM, Michael Chandler <
Michael.Chandler@onassignment.com> wrote:
> This happens to me only after login, and I am also using Tomcat.
>
>
>
> *From:* Albert Kam [mailto:moonblade.wolf@gmail.com]
> *Sent:* Friday, November 15, 2013 10:13 AM
> *To:* user@shiro.apache.org
> *Subject:* Re: Removing ;JSESSIONID=xxx from the url after login ?
>
>
>
> Thanks for sharing.
>
>
>
> I just downloaded the latest tapestry, along with tapestry security
> (shiro) source,
>
> and grepping jsessionid string doesnt show up anything.
>
> I suspect this might be container issue then.
>
>
>
> I wonder if everyone experiencing the same problem uses tomcat only :)
>
>
>
>
>
> On Sat, Nov 16, 2013 at 12:40 AM, Lenny Primak <lp...@hope.nyc.ny.us>
> wrote:
>
> I don't remember the exact specifics now (it's been a while since I've
> seen this)
>
> but I will try to answer.
>
>
>
> I am using Tapestry and Tapestry-Security with Shiro. Tapestry-Security
> has it's own Shiro filter
>
> which isn't a "real" Servlet filter but something similar in Tapestry
> world. I am not using pre-built Shiro filter.
>
> I NEVER see ;JSESSIONID anywhere in the URL. Ever.
>
>
>
> On Nov 15, 2013, at 12:14 PM, Albert Kam wrote:
>
>
>
> Hello Lenny, i'm curious about your success story.
>
> Setting session-config works fine also for me, JSESSIONID is gone for all
> urls,
>
> except the url that's produced after a successful login, which in my
> case the session is first created.
>
>
>
> I hope you dont mind asking some specifics :
>
> - Do you use apache shiro filter for login ?
>
> - Do JSESSIONID shows up in the first request for the webapp ?
>
> or perhaps it shows up after the first successful login ?
>
>
>
>
>
> On Fri, Nov 15, 2013 at 11:52 PM, Lenny Primak <lp...@hope.nyc.ny.us>
> wrote:
>
> I was able to fix it with previously suggested session-config command in
> web.xml
> Not sure why it didn't work for some people on here but it worked for me
> on glassfish.
>
>
> > On Nov 15, 2013, at 9:01 AM, versatec <ro...@versatec.de> wrote:
> >
> > whoops, missed the part where you say the JSESSIONID is appended to url
> > *after *login. On glassfish it happens only when the *login page itself
> is
> > displayed* both when logout redirects to login page or when navigation
> > points to login page first time
> >
> >
> >
> > --
> > View this message in context:
> http://shiro-user.582556.n2.nabble.com/Removing-JSESSIONID-xxx-from-the-url-after-login-tp7579370p7579383.html
> > Sent from the Shiro User mailing list archive at Nabble.com.
> >
>
>
>
>
>
> --
> Do not pursue the past. Do not lose yourself in the future.
> The past no longer is. The future has not yet come.
> Looking deeply at life as it is in the very here and now,
> the practitioner dwells in stability and freedom.
> (Thich Nhat Hanh)
>
>
>
>
>
>
>
> --
> Do not pursue the past. Do not lose yourself in the future.
> The past no longer is. The future has not yet come.
> Looking deeply at life as it is in the very here and now,
> the practitioner dwells in stability and freedom.
> (Thich Nhat Hanh)
>
> The information transmitted, including attachments, is intended only for
> the person or entity to which it is addressed and may contain confidential
> and/or privileged material. Any review, retransmission, dissemination or
> other use of, or taking of any action in reliance upon this information by
> persons or entities other than the intended recipient is prohibited. If you
> received this e-mail in error, please notify the sender immediately by
> replying to the message and deleting the material from your computer.
>
--
Do not pursue the past. Do not lose yourself in the future.
The past no longer is. The future has not yet come.
Looking deeply at life as it is in the very here and now,
the practitioner dwells in stability and freedom.
(Thich Nhat Hanh)
RE: Removing ;JSESSIONID=xxx from the url after login ?
Posted by Michael Chandler <Mi...@onassignment.com>.
This happens to me only after login, and I am also using Tomcat.
From: Albert Kam [mailto:moonblade.wolf@gmail.com]
Sent: Friday, November 15, 2013 10:13 AM
To: user@shiro.apache.org
Subject: Re: Removing ;JSESSIONID=xxx from the url after login ?
Thanks for sharing.
I just downloaded the latest tapestry, along with tapestry security (shiro) source,
and grepping jsessionid string doesnt show up anything.
I suspect this might be container issue then.
I wonder if everyone experiencing the same problem uses tomcat only :)
On Sat, Nov 16, 2013 at 12:40 AM, Lenny Primak <lp...@hope.nyc.ny.us>> wrote:
I don't remember the exact specifics now (it's been a while since I've seen this)
but I will try to answer.
I am using Tapestry and Tapestry-Security with Shiro. Tapestry-Security has it's own Shiro filter
which isn't a "real" Servlet filter but something similar in Tapestry world. I am not using pre-built Shiro filter.
I NEVER see ;JSESSIONID anywhere in the URL. Ever.
On Nov 15, 2013, at 12:14 PM, Albert Kam wrote:
Hello Lenny, i'm curious about your success story.
Setting session-config works fine also for me, JSESSIONID is gone for all urls,
except the url that's produced after a successful login, which in my case the session is first created.
I hope you dont mind asking some specifics :
- Do you use apache shiro filter for login ?
- Do JSESSIONID shows up in the first request for the webapp ?
or perhaps it shows up after the first successful login ?
On Fri, Nov 15, 2013 at 11:52 PM, Lenny Primak <lp...@hope.nyc.ny.us>> wrote:
I was able to fix it with previously suggested session-config command in web.xml
Not sure why it didn't work for some people on here but it worked for me on glassfish.
> On Nov 15, 2013, at 9:01 AM, versatec <ro...@versatec.de>> wrote:
>
> whoops, missed the part where you say the JSESSIONID is appended to url
> *after *login. On glassfish it happens only when the *login page itself is
> displayed* both when logout redirects to login page or when navigation
> points to login page first time
>
>
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/Removing-JSESSIONID-xxx-from-the-url-after-login-tp7579370p7579383.html
> Sent from the Shiro User mailing list archive at Nabble.com<http://Nabble.com>.
>
--
Do not pursue the past. Do not lose yourself in the future.
The past no longer is. The future has not yet come.
Looking deeply at life as it is in the very here and now,
the practitioner dwells in stability and freedom.
(Thich Nhat Hanh)
--
Do not pursue the past. Do not lose yourself in the future.
The past no longer is. The future has not yet come.
Looking deeply at life as it is in the very here and now,
the practitioner dwells in stability and freedom.
(Thich Nhat Hanh)
The information transmitted, including attachments, is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this e-mail in error, please notify the sender immediately by replying to the message and deleting the material from your computer.
Re: Removing ;JSESSIONID=xxx from the url after login ?
Posted by Albert Kam <mo...@gmail.com>.
Thanks for sharing.
I just downloaded the latest tapestry, along with tapestry security (shiro)
source,
and grepping jsessionid string doesnt show up anything.
I suspect this might be container issue then.
I wonder if everyone experiencing the same problem uses tomcat only :)
On Sat, Nov 16, 2013 at 12:40 AM, Lenny Primak <lp...@hope.nyc.ny.us>wrote:
> I don't remember the exact specifics now (it's been a while since I've
> seen this)
> but I will try to answer.
>
> I am using Tapestry and Tapestry-Security with Shiro. Tapestry-Security
> has it's own Shiro filter
> which isn't a "real" Servlet filter but something similar in Tapestry
> world. I am not using pre-built Shiro filter.
> I NEVER see ;JSESSIONID anywhere in the URL. Ever.
>
> On Nov 15, 2013, at 12:14 PM, Albert Kam wrote:
>
> Hello Lenny, i'm curious about your success story.
> Setting session-config works fine also for me, JSESSIONID is gone for all
> urls,
> except the url that's produced after a successful login, which in my
> case the session is first created.
>
> I hope you dont mind asking some specifics :
> - Do you use apache shiro filter for login ?
> - Do JSESSIONID shows up in the first request for the webapp ?
> or perhaps it shows up after the first successful login ?
>
>
>
> On Fri, Nov 15, 2013 at 11:52 PM, Lenny Primak <lp...@hope.nyc.ny.us>wrote:
>
>> I was able to fix it with previously suggested session-config command in
>> web.xml
>> Not sure why it didn't work for some people on here but it worked for me
>> on glassfish.
>>
>> > On Nov 15, 2013, at 9:01 AM, versatec <ro...@versatec.de>
>> wrote:
>> >
>> > whoops, missed the part where you say the JSESSIONID is appended to url
>> > *after *login. On glassfish it happens only when the *login page itself
>> is
>> > displayed* both when logout redirects to login page or when navigation
>> > points to login page first time
>> >
>> >
>> >
>> > --
>> > View this message in context:
>> http://shiro-user.582556.n2.nabble.com/Removing-JSESSIONID-xxx-from-the-url-after-login-tp7579370p7579383.html
>> > Sent from the Shiro User mailing list archive at Nabble.com.
>> >
>>
>
>
>
> --
> Do not pursue the past. Do not lose yourself in the future.
> The past no longer is. The future has not yet come.
> Looking deeply at life as it is in the very here and now,
> the practitioner dwells in stability and freedom.
> (Thich Nhat Hanh)
>
>
>
--
Do not pursue the past. Do not lose yourself in the future.
The past no longer is. The future has not yet come.
Looking deeply at life as it is in the very here and now,
the practitioner dwells in stability and freedom.
(Thich Nhat Hanh)
Re: Removing ;JSESSIONID=xxx from the url after login ?
Posted by Lenny Primak <lp...@hope.nyc.ny.us>.
I don't remember the exact specifics now (it's been a while since I've seen this)
but I will try to answer.
I am using Tapestry and Tapestry-Security with Shiro. Tapestry-Security has it's own Shiro filter
which isn't a "real" Servlet filter but something similar in Tapestry world. I am not using pre-built Shiro filter.
I NEVER see ;JSESSIONID anywhere in the URL. Ever.
On Nov 15, 2013, at 12:14 PM, Albert Kam wrote:
> Hello Lenny, i'm curious about your success story.
> Setting session-config works fine also for me, JSESSIONID is gone for all urls,
> except the url that's produced after a successful login, which in my case the session is first created.
>
> I hope you dont mind asking some specifics :
> - Do you use apache shiro filter for login ?
> - Do JSESSIONID shows up in the first request for the webapp ?
> or perhaps it shows up after the first successful login ?
>
>
>
> On Fri, Nov 15, 2013 at 11:52 PM, Lenny Primak <lp...@hope.nyc.ny.us> wrote:
> I was able to fix it with previously suggested session-config command in web.xml
> Not sure why it didn't work for some people on here but it worked for me on glassfish.
>
> > On Nov 15, 2013, at 9:01 AM, versatec <ro...@versatec.de> wrote:
> >
> > whoops, missed the part where you say the JSESSIONID is appended to url
> > *after *login. On glassfish it happens only when the *login page itself is
> > displayed* both when logout redirects to login page or when navigation
> > points to login page first time
> >
> >
> >
> > --
> > View this message in context: http://shiro-user.582556.n2.nabble.com/Removing-JSESSIONID-xxx-from-the-url-after-login-tp7579370p7579383.html
> > Sent from the Shiro User mailing list archive at Nabble.com.
> >
>
>
>
> --
> Do not pursue the past. Do not lose yourself in the future.
> The past no longer is. The future has not yet come.
> Looking deeply at life as it is in the very here and now,
> the practitioner dwells in stability and freedom.
> (Thich Nhat Hanh)
Re: Removing ;JSESSIONID=xxx from the url after login ?
Posted by Albert Kam <mo...@gmail.com>.
Hello Lenny, i'm curious about your success story.
Setting session-config works fine also for me, JSESSIONID is gone for all
urls,
except the url that's produced after a successful login, which in my case
the session is first created.
I hope you dont mind asking some specifics :
- Do you use apache shiro filter for login ?
- Do JSESSIONID shows up in the first request for the webapp ?
or perhaps it shows up after the first successful login ?
On Fri, Nov 15, 2013 at 11:52 PM, Lenny Primak <lp...@hope.nyc.ny.us>wrote:
> I was able to fix it with previously suggested session-config command in
> web.xml
> Not sure why it didn't work for some people on here but it worked for me
> on glassfish.
>
> > On Nov 15, 2013, at 9:01 AM, versatec <ro...@versatec.de> wrote:
> >
> > whoops, missed the part where you say the JSESSIONID is appended to url
> > *after *login. On glassfish it happens only when the *login page itself
> is
> > displayed* both when logout redirects to login page or when navigation
> > points to login page first time
> >
> >
> >
> > --
> > View this message in context:
> http://shiro-user.582556.n2.nabble.com/Removing-JSESSIONID-xxx-from-the-url-after-login-tp7579370p7579383.html
> > Sent from the Shiro User mailing list archive at Nabble.com.
> >
>
--
Do not pursue the past. Do not lose yourself in the future.
The past no longer is. The future has not yet come.
Looking deeply at life as it is in the very here and now,
the practitioner dwells in stability and freedom.
(Thich Nhat Hanh)
Re: Removing ;JSESSIONID=xxx from the url after login ?
Posted by Lenny Primak <lp...@hope.nyc.ny.us>.
I was able to fix it with previously suggested session-config command in web.xml
Not sure why it didn't work for some people on here but it worked for me on glassfish.
> On Nov 15, 2013, at 9:01 AM, versatec <ro...@versatec.de> wrote:
>
> whoops, missed the part where you say the JSESSIONID is appended to url
> *after *login. On glassfish it happens only when the *login page itself is
> displayed* both when logout redirects to login page or when navigation
> points to login page first time
>
>
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/Removing-JSESSIONID-xxx-from-the-url-after-login-tp7579370p7579383.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>
Re: Removing ;JSESSIONID=xxx from the url after login ?
Posted by versatec <ro...@versatec.de>.
whoops, missed the part where you say the JSESSIONID is appended to url
*after *login. On glassfish it happens only when the *login page itself is
displayed* both when logout redirects to login page or when navigation
points to login page first time
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Removing-JSESSIONID-xxx-from-the-url-after-login-tp7579370p7579383.html
Sent from the Shiro User mailing list archive at Nabble.com.
RE: Removing ;JSESSIONID=xxx from the url after login ?
Posted by Michael Chandler <Mi...@onassignment.com>.
Albert,
I'm experiencing the exact same issue so I'm curious to know if you find a resolution to this problem. I'm running the same version of Tomcat that you are running and have tried the same things. I hope you can turn up a clue on how to address the issue because I didn't.
Mike
From: Albert Kam [mailto:moonblade.wolf@gmail.com]
Sent: Thursday, November 14, 2013 6:58 AM
To: user@shiro.apache.org
Subject: Re: Removing ;JSESSIONID=xxx from the url after login ?
Thank you for sharing your success story !
Sorry that i forgot to mention i already had what you suggested in the web.xml :
<session-config>
<tracking-mode>COOKIE</tracking-mode>
</session-config>
I also made sure that the dtd is correctly pointing to 3.0 :
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
version="3.0">
And i'm running under Tomcat 7.0.42 which already supports servlet 3.0.
And actually JSESSIONID showed up _only_ after the login process. There's no more JSESSIONID in any urls afterwards.
Here is my related web.xml entries :
<!-- has to come first before applying any other filter, otherwise encoding will fail -->
<filter>
<filter-name>encodingFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
<init-param>
<param-name>forceEncoding</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter>
<display-name>JsessionId Filter</display-name>
<filter-name>jsessionIdAvoiderFilter</filter-name>
<filter-class>web.JsessionIdAvoiderFilter</filter-class>
</filter>
<filter>
<filter-name>httpMethodFilter</filter-name>
<filter-class>org.springframework.web.filter.HiddenHttpMethodFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>encodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
<dispatcher>INCLUDE</dispatcher>
<dispatcher>ERROR</dispatcher>
</filter-mapping>
<filter-mapping>
<filter-name>jsessionIdAvoiderFilter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
<filter-mapping>
<filter-name>httpMethodFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<session-config>
<tracking-mode>COOKIE</tracking-mode>
</session-config>
I also tried swapping place between shiroFilter and jsessionIdAvoiderFilter,
but with the same result of still containing the ;JSESSIONID=xxx
And this is my shiro filter configuration :
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager"/>
<property name="loginUrl" value="/login"/>
<property name="successUrl" value="/"/>
<property name="unauthorizedUrl" value="/signup"/>
<property name="filterChainDefinitions">
<value>
/login = authc
/logout = noSessionCreation, logout
/** = noSessionCreation, anon
</value>
</property>
</bean>
I'm using freemarker, so the session thing in JSP shouldnt be an issue, since i'm using any JSPs.
My jsessionIdAvoiderFilter is simple :
public class JsessionIdAvoiderFilter implements Filter {
@Override
public void doFilter(ServletRequest req, ServletResponse res,
FilterChain chain) throws IOException, ServletException {
if (!(req instanceof HttpServletRequest)) {
chain.doFilter(req, res);
return;
}
HttpServletResponse response = (HttpServletResponse) res;
// Prevent rendering of JSESSIONID in URLs for all outgoing links
HttpServletResponseWrapper wrappedResponse = new HttpServletResponseWrapper(response) {
@Override
public String encodeRedirectUrl(String url) {
return url;
}
@Override
public String encodeRedirectURL(String url) {
return url;
}
@Override
public String encodeUrl(String url) {
return url;
}
@Override
public String encodeURL(String url) {
return url;
}
};
chain.doFilter(req, wrappedResponse);
}
@Override
public void destroy() {
}
@Override
public void init(FilterConfig arg0) throws ServletException {
}
}
Thanks for your time !
The information transmitted, including attachments, is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this e-mail in error, please notify the sender immediately by replying to the message and deleting the material from your computer.
Re: Removing ;JSESSIONID=xxx from the url after login ?
Posted by Albert Kam <mo...@gmail.com>.
Thank you for sharing your success story !
Sorry that i forgot to mention i already had what you suggested in the
web.xml :
<session-config>
<tracking-mode>COOKIE</tracking-mode>
</session-config>
I also made sure that the dtd is correctly pointing to 3.0 :
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
version="3.0">
And i'm running under Tomcat 7.0.42 which already supports servlet 3.0.
And actually JSESSIONID showed up _only_ after the login process. There's
no more JSESSIONID in any urls afterwards.
Here is my related web.xml entries :
<!-- has to come first before applying any other filter, otherwise encoding
will fail -->
<filter>
<filter-name>encodingFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
<init-param>
<param-name>forceEncoding</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter>
<display-name>JsessionId Filter</display-name>
<filter-name>jsessionIdAvoiderFilter</filter-name>
<filter-class>web.JsessionIdAvoiderFilter</filter-class>
</filter>
<filter>
<filter-name>httpMethodFilter</filter-name>
<filter-class>org.springframework.web.filter.HiddenHttpMethodFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>encodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
<dispatcher>INCLUDE</dispatcher>
<dispatcher>ERROR</dispatcher>
</filter-mapping>
<filter-mapping>
<filter-name>jsessionIdAvoiderFilter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
<filter-mapping>
<filter-name>httpMethodFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<session-config>
<tracking-mode>COOKIE</tracking-mode>
</session-config>
I also tried swapping place between shiroFilter and
jsessionIdAvoiderFilter,
but with the same result of still containing the ;JSESSIONID=xxx
And this is my shiro filter configuration :
<bean id="shiroFilter"
class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager"/>
<property name="loginUrl" value="/login"/>
<property name="successUrl" value="/"/>
<property name="unauthorizedUrl" value="/signup"/>
<property name="filterChainDefinitions">
<value>
/login = authc
/logout = noSessionCreation, logout
/** = noSessionCreation, anon
</value>
</property>
</bean>
I'm using freemarker, so the session thing in JSP shouldnt be an issue,
since i'm using any JSPs.
My jsessionIdAvoiderFilter is simple :
public class JsessionIdAvoiderFilter implements Filter {
@Override
public void doFilter(ServletRequest req, ServletResponse res,
FilterChain chain) throws IOException, ServletException {
if (!(req instanceof HttpServletRequest)) {
chain.doFilter(req, res);
return;
}
HttpServletResponse response = (HttpServletResponse) res;
// Prevent rendering of JSESSIONID in URLs for all outgoing links
HttpServletResponseWrapper wrappedResponse = new
HttpServletResponseWrapper(response) {
@Override
public String encodeRedirectUrl(String url) {
return url;
}
@Override
public String encodeRedirectURL(String url) {
return url;
}
@Override
public String encodeUrl(String url) {
return url;
}
@Override
public String encodeURL(String url) {
return url;
}
};
chain.doFilter(req, wrappedResponse);
}
@Override
public void destroy() {
}
@Override
public void init(FilterConfig arg0) throws ServletException {
}
}
Thanks for your time !
On Thu, Nov 14, 2013 at 9:34 PM, Josh Berry <ta...@gmail.com> wrote:
> I had success with setting <tracking-mode> to COOKIE in my web.xml.
>
> Otherwise, if you want to do this with a filter, you'll have to make sure
> your filter is installed at the correct place in the filter chain so that
> it sees this to remove it. If you can't make any headway on where to place
> it, I can probably take a closer look today.
>
> -josh
>
>
> On Thu, Nov 14, 2013 at 7:49 AM, Albert Kam <mo...@gmail.com>wrote:
>
>> Hello, i'm currently using the latest stable version of Apache Shiro.
>>
>> Everything has been working fine, until i want to remove ;JSESSIONID=xxx
>> from the url after successful login.
>>
>> I tried suggestion here, by creating a filter that is making use of a
>> wrappedResponse, and register it into my web.xml, but still failing.
>>
>> Has anyone here successfully done this before ?
>>
>> Thank you,
>> Albert Kam
>>
>> --
>> Do not pursue the past. Do not lose yourself in the future.
>> The past no longer is. The future has not yet come.
>> Looking deeply at life as it is in the very here and now,
>> the practitioner dwells in stability and freedom.
>> (Thich Nhat Hanh)
>>
>
>
--
Do not pursue the past. Do not lose yourself in the future.
The past no longer is. The future has not yet come.
Looking deeply at life as it is in the very here and now,
the practitioner dwells in stability and freedom.
(Thich Nhat Hanh)
Re: Removing ;JSESSIONID=xxx from the url after login ?
Posted by Josh Berry <ta...@gmail.com>.
I had success with setting <tracking-mode> to COOKIE in my web.xml.
Otherwise, if you want to do this with a filter, you'll have to make sure
your filter is installed at the correct place in the filter chain so that
it sees this to remove it. If you can't make any headway on where to place
it, I can probably take a closer look today.
-josh
On Thu, Nov 14, 2013 at 7:49 AM, Albert Kam <mo...@gmail.com>wrote:
> Hello, i'm currently using the latest stable version of Apache Shiro.
>
> Everything has been working fine, until i want to remove ;JSESSIONID=xxx
> from the url after successful login.
>
> I tried suggestion here, by creating a filter that is making use of a
> wrappedResponse, and register it into my web.xml, but still failing.
>
> Has anyone here successfully done this before ?
>
> Thank you,
> Albert Kam
>
> --
> Do not pursue the past. Do not lose yourself in the future.
> The past no longer is. The future has not yet come.
> Looking deeply at life as it is in the very here and now,
> the practitioner dwells in stability and freedom.
> (Thich Nhat Hanh)
>