Resource bundles session dependency?

[Helge Tesgaard <he...@tesgaard.dk>]

It loks like that the Struts Localization support is dependent on sessions. Is it true that using bean message tags vould initiate a session?

I have a application that have public and a restricted areas. It uses struts sub applications and it uses form based authentication. The jsp containing the login form(of cource public) has texts that is loaded from the resource bundle. The login form(jsp) is provided by an action from the root struts application.  

The problem i have is that a session is initiated when the login action(set to request scope) providing on the login form jsp is requested. This initiates a session but i would like to avoid this becourse of the denial of service attacks vulnerability it gives. I'm wonering if the bean message tags is session dependent and if thats the case is it enough to exclude the bean message tags from the login form jsp page?

Thank You!
----
Helg Tesgaard

---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org