Session tracking with URL rewriting does not work with higher versions of struts.

[Anju Geethabai <ag...@in.ibm.com>]

Our application is built on struts frame work.. 
Moving from a previous version of struts (1.0.2) to struts 1.1 we have 
seen that  Session management using URL rewriting is not working properly.
Our  logs shows that the class  RequestProcessor from struts is throwing 
the below error
[4/7/05 15:26:21:449 IST] 00000029 RequestProces E   Invalid path 
;jsessionid=0000YA6Ii38gBdA2u8Nbf7EKc8c:-1 was requested

We tried printing out the request paramters when invoking an applicatiion 
which is using session handling through URL rewriting.

The results: 

using Struts 1.0.2

URL invoked -> 
http://localhost:9080/snoop;jsessionid=0000gE0mwjqt37iqNxCy0s2U015:--1
Pathinfo =<none>

Using Struts 1.1

URL invoked -> 
http://localhost:9080/snoop;jsessionid=0000gE0mwjqt37iqNxCy0s2U015:--1
pathinfo =;jsessionid=0000gE0mwjqt37iqNxCy0s2U015:--1

On further analysis this is what we have found out.
There is no "RequestProcessor.java" in struts 1.0.2 . This class is been 
introduced from struts1.1. Enabling struts trace i could see that struts 
ActionServlet is calling "sendError 400 Invalid path 
;jsessionid=0000gE0mwjqt37IqNxCy0s2UO15:-1 was requested"  when it cannot 
find the path mapping. The reason i think same code is working on v5 and 
not on v6 is there might be a behavior change to "request.getPathInfo()" 
method. What i noticed is in v5, when there is jsessionid in path it is 
getting ignored by getPathInfo but in v6 its returning even jsessionid. 
Ideally, struts code should be handling the case where we have jsessionid 
for the path info.
It looks like struts may  need to trim off path parameters (ones that 
start with ;jsessionid) when checking if pathInfo exists or not. 

Please let us know if this issue has been resolved or will be taken up.
Thanks  for any help regarding this 

Regards
Anju

Re: Session tracking with URL rewriting does not work with higher versions of struts.

[Joe Germuska <Jo...@Germuska.com>]

>On further analysis this is what we have found out.
>There is no "RequestProcessor.java" in struts 1.0.2 . This class is been
>introduced from struts1.1. Enabling struts trace i could see that struts
>ActionServlet is calling "sendError 400 Invalid path
>;jsessionid=0000gE0mwjqt37IqNxCy0s2UO15:-1 was requested"  when it cannot
>find the path mapping. The reason i think same code is working on v5 and
>not on v6 is there might be a behavior change to "request.getPathInfo()"
>method. What i noticed is in v5, when there is jsessionid in path it is
>getting ignored by getPathInfo but in v6 its returning even jsessionid.
>Ideally, struts code should be handling the case where we have jsessionid
>for the path info.
>It looks like struts may  need to trim off path parameters (ones that
>start with ;jsessionid) when checking if pathInfo exists or not.

What servlet container are you using?  Struts should have no 
responsibilities regarding session management; this should all be 
dealt with before the servlet is invoked; in fact, I do not believe 
that any servlet container I've ever used passes the jsessionid as 
part of the path info, although I can't say that I've definitively 
tested it.

You refer to "v5" and "v6" with no referents.  Are those versions of 
the servlet container you use?  Or of your application?

I've been writing Struts apps for years that run on Tomcat 4 and 5 
and JBoss 3.2.x without ever having any problems with path-encoded 
session IDs.  But it's been quite a while since I was working on a 
Struts 1.0.x app.

Joe

-- 
Joe Germuska            
Joe@Germuska.com  
http://blog.germuska.com    
"Narrow minds are weapons made for mass destruction"  -The Ex

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org