You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@wicket.apache.org by "Martin Grigorov (JIRA)" <ji...@apache.org> on 2013/07/11 13:53:50 UTC
[jira] [Reopened] (WICKET-5164) PageStoreManager.SessionEntry keeps
outdated sessionId when container changes sessionId
[ https://issues.apache.org/jira/browse/WICKET-5164?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Martin Grigorov reopened WICKET-5164:
-------------------------------------
> PageStoreManager.SessionEntry keeps outdated sessionId when container changes sessionId
> ---------------------------------------------------------------------------------------
>
> Key: WICKET-5164
> URL: https://issues.apache.org/jira/browse/WICKET-5164
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 6.7.0, 7.0.0
> Reporter: Sven Meier
> Assignee: Sven Meier
> Fix For: 7.0.0, 6.10.0
>
>
> PageStoreManager keeps the initial sessionId for each SessionEntry.
> If the container changes the sessionId later (e.g. Tomcat's "Session Fixation Protection"), all pages continue to be stored under the the initial sessionId. This is necessary to be able to access old pages even after a change to the sessionId.
> However PageStoreManager#sessionExpired(String) passes the *current* sessionId to the PageStore. If it is not longer equal the original sessionId, the PageStore will fail to remove the stored pages for the session.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira