Re: login session

[Randy Watler <wa...@wispertel.net>]

James,

I think we need to consider whether a new session should be started or 
not in the login servlet.
We will need to get input from the rest of the team, most notably Ate.

Of course you can keep using your workaround. As usual, SVN pulls are 
not necessarily
stable, but we do try hard to keep it that way. Thanks for the input and 
alerting us to this
issue in the first place!

Randy

James Liao wrote:

>Hi David,
>I test it again thoroghly. But the problem still exist. It seems that
>the problem is cause by the following reason:
>1. Each time the JetspeedRequestContext try to get something from
>session, it will call HttpServletRequest.getSession(), so there is a
>session for guest user.
>
>2. When you try to login to portal, LoginServlet will call 
>"HttpSession session = request.getSession(true);" This does not make
>sure to create a new session for this login action. The following is
>the Java Doc for this method:
>
>Returns the current HttpSession  associated with this request or, if
>if there is no current session and create is true, returns a new
>session.
>
>So it is the same session for the guest and user(admin, manager or
>someone else).
>
>I think we could fix this problem by call
>"session.removeAttribute(PageProfilerValve.PROFILE_LOCATORS_PER_PRINCIPAL);"
>after "HttpSession session = request.getSession(true);" in
>LoginServlet.java. It will clear this attribute.
>
>My entironment:
>JDK 1.4.2_07
>WinXP SP2
>
>-James Liao
>
>On 6/28/05, David Sean Taylor <da...@bluesunrise.com> wrote:
>  
>
>>James Liao wrote:
>>    
>>
>>>Hi david,
>>>I have update to the latest J2, I found a problem about your optimize
>>>for ProfilerValve.
>>>
>>>For the first time, I visit J2 portal, I got a guest principal as
>>>default, you will getProfileLocators for guest principal and store
>>>into session.
>>>
>>>When I login as admin, the session is still the same session for
>>>previous guest, so it will not recreate the locators, still use the
>>>old locators for guest. I can't go anywhere except the
>>>default-page.psml. I think it is wrong.
>>>
>>>      
>>>
>>Well, IMO logging on should create a new session.
>>
>>--
>>David Sean Taylor
>>Bluesunrise Software
>>david@bluesunrise.com
>>[office] +01 707 773-4646
>>[mobile] +01 707 529 9194
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
>>For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
>>
>>
>>    
>>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
>For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
>
>
>
>  
>


---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org