[jira] [Commented] (DELTASPIKE-1071) URLs like ?&dswid=XYZ lead to window cloning

["Sean Flanigan (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/DELTASPIKE-1071?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15133463#comment-15133463 ] 

Sean Flanigan commented on DELTASPIKE-1071:
-------------------------------------------

Thanks for the quick work [~tandraschko]; that seems to fix the specific (artificial) example I gave. 

The cloning problem still happens in my application with urlrewrite when the URL is a broken one like {{.../page.xhtml&dswid=XYZ}}. Unfortunately, I'm not currently able to create a working test case for that, because the JSF playground (quite naturally) gives a 404 when you try to visit a URL like {{http://localhost:8080/ds/views/windowhandling/lazy/test.xhtml&dswid=-4227}}.

> URLs like ?&dswid=XYZ lead to window cloning
> --------------------------------------------
>
>                 Key: DELTASPIKE-1071
>                 URL: https://issues.apache.org/jira/browse/DELTASPIKE-1071
>             Project: DeltaSpike
>          Issue Type: Bug
>          Components: JSF-Module
>    Affects Versions: 1.5.1, 1.5.2
>            Reporter: Sean Flanigan
>            Assignee: Thomas Andraschko
>             Fix For: 1.5.3
>
>
> Using default window mode on Chrome (equates to LAZY?), if a clickable URL ends in {{?&dswid=XYZ}}, opening that link in a new tab clones the old tab's {{window.name}} and {{dswid}}, instead of generating a new id.
> I had this (very confusing) problem in my application when a urlrewrite outbound-rule accidentally used {{&dswid=XYZ}} instead of {{?dswid=XYZ}}, but for simple applications it is easiest to reproduce like this:
> 1. visit a page URL which ends with {{?dswid=XYZ}}
> 2. use the javascript console to check {{window.name}}
> 3. edit the URL so that it ends with {{?&dswid=XYZ}}
> 4. paste the edited URL into a fresh browser tab (where {{window.name}} is empty)
> 5. use the javascript console to check {{window.name}} for the new tab
> Both tabs have the same {{window.name}}, which leads to all window-based scopes in the session being shared for future requests in the affected tabs.
> I haven't dug into the code too closely, but I suspect {{windowhandler.js}} is setting {{window.name}} when it sees {{&dswid}} in the URL, instead of triggering a lazy redirect as I think it should.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)