You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Colin Evans <ce...@bitmo.com> on 2000/10/31 23:13:15 UTC
RequestDispatcher breaks cookies, response headers
Hi, I believe I have found a bad bug in the RequestDispatcher
implementation. If I do a successful RequestDispatcher.include() from one
servlet to another, it appears that no HTTP response headers are returned
except for "Content-Type". Everything else seems to respond correctly.
"Location", "Content-Length", and "Servlet-Engine" headers as well as
headers set in the servlet are not returned, and neither are any session or
user cookies returned. This basically breaks all
model-view-controller-based sites that use cookies, and for me is a serious
bug.
I've seen the problem on Tomcat 3.1 and 3.2b6. I'm running NT4.0 with Sun
JDK 1.2.2. I would appreciate ideas on work-arounds or patches.
Thanks!
Colin Evans
--
Colin Evans
Bitmo, Inc. (http://www.bitmo.com)
(415)920.7225 / cevans@bitmo.com
Re: RequestDispatcher breaks cookies, response headers
Posted by "Craig R. McClanahan" <Cr...@eng.sun.com>.
Colin Evans wrote:
> Headers set in the outermost servlet are not returned. No headers are
> returned at all, except for "Content-type". HTTP session cookies that
> Tomcat is supposed to set automatically are not returned at all. The
> "Content-Length" and "Servlet-Engine" headers that Tomcat faithfully sets
> automatically for all servlet requests are not returned in this case.
> Cookies added in the outermost servlet are not returned.
Thanks Colin ... sorry to be so dense ... now that's a test case I can
easily
create and play with. I'll let you know (one way or the other) what I
find.
>
> -Colin
Craig
Re: RequestDispatcher breaks cookies, response headers
Posted by Colin Evans <ce...@bitmo.com>.
Headers set in the outermost servlet are not returned. No headers are
returned at all, except for "Content-type". HTTP session cookies that
Tomcat is supposed to set automatically are not returned at all. The
"Content-Length" and "Servlet-Engine" headers that Tomcat faithfully sets
automatically for all servlet requests are not returned in this case.
Cookies added in the outermost servlet are not returned.
-Colin
--
Colin Evans
Bitmo, Inc. (http://www.bitmo.com)
(415)920.7225 / cevans@bitmo.com
----- Original Message -----
From: "Craig R. McClanahan" <Cr...@eng.sun.com>
To: <to...@jakarta.apache.org>
Sent: Saturday, November 04, 2000 3:52 PM
Subject: Re: RequestDispatcher breaks cookies, response headers
> Colin Evans wrote:
>
> > When a RequestDispatcher.include() is done, *no* return headers are set
at
> > all, except for "Content-Type". It doesn't matter where the headers are
> > set. This includes return headers that the Tomcat container is supposed
to
> > set automatically for all servlet requests, such as "Content-Length" and
> > "Servlet-Engine" headers and any HTTP session cookies.
>
> Where are you trying to set the headers? As I pointed out from the spec,
an
> included servlet is not allowed to set them -- only the outermost calling
> servlet can do so.
>
> >
> > RequestDispatcher.forward() seems to function correctly. My guess is
that
> > Tomcat is supposed to delete any return headers set during an include
and
> > not touch headers set by the dispatching servlet, and instead it is
deleting
> > all of the return headers set during the request, including headers that
> > should be returned as per the spec.
>
> There was a bug in 3.1 that caused headers set before a forward call to be
> thrown away, but that's been fixed in 3.2. A forwarded-to servlet is
allowed to
> set headers, but not an included servlet.
>
> >
> > I hope this helps; let me know if you need more explanations.
> >
> > -Colin
> >
>
> Craig
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
Re: RequestDispatcher breaks cookies, response headers
Posted by "Craig R. McClanahan" <Cr...@eng.sun.com>.
Colin Evans wrote:
> When a RequestDispatcher.include() is done, *no* return headers are set at
> all, except for "Content-Type". It doesn't matter where the headers are
> set. This includes return headers that the Tomcat container is supposed to
> set automatically for all servlet requests, such as "Content-Length" and
> "Servlet-Engine" headers and any HTTP session cookies.
Where are you trying to set the headers? As I pointed out from the spec, an
included servlet is not allowed to set them -- only the outermost calling
servlet can do so.
>
> RequestDispatcher.forward() seems to function correctly. My guess is that
> Tomcat is supposed to delete any return headers set during an include and
> not touch headers set by the dispatching servlet, and instead it is deleting
> all of the return headers set during the request, including headers that
> should be returned as per the spec.
There was a bug in 3.1 that caused headers set before a forward call to be
thrown away, but that's been fixed in 3.2. A forwarded-to servlet is allowed to
set headers, but not an included servlet.
>
> I hope this helps; let me know if you need more explanations.
>
> -Colin
>
Craig
Re: RequestDispatcher breaks cookies, response headers
Posted by Colin Evans <ce...@bitmo.com>.
When a RequestDispatcher.include() is done, *no* return headers are set at
all, except for "Content-Type". It doesn't matter where the headers are
set. This includes return headers that the Tomcat container is supposed to
set automatically for all servlet requests, such as "Content-Length" and
"Servlet-Engine" headers and any HTTP session cookies.
RequestDispatcher.forward() seems to function correctly. My guess is that
Tomcat is supposed to delete any return headers set during an include and
not touch headers set by the dispatching servlet, and instead it is deleting
all of the return headers set during the request, including headers that
should be returned as per the spec.
I hope this helps; let me know if you need more explanations.
-Colin
--
Colin Evans
Bitmo, Inc. (http://www.bitmo.com)
(415)920.7225 / cevans@bitmo.com
----- Original Message -----
From: "Craig R. McClanahan" <Cr...@eng.sun.com>
To: <to...@jakarta.apache.org>; <ce...@bitmo.com>
Sent: Saturday, November 04, 2000 2:56 PM
Subject: Re: RequestDispatcher breaks cookies, response headers
> Colin Evans wrote:
>
> > Hi, I believe I have found a bad bug in the RequestDispatcher
> > implementation. If I do a successful RequestDispatcher.include() from
one
> > servlet to another, it appears that no HTTP response headers are
returned
> > except for "Content-Type". Everything else seems to respond correctly.
> > "Location", "Content-Length", and "Servlet-Engine" headers as well as
> > headers set in the servlet are not returned, and neither are any session
or
> > user cookies returned. This basically breaks all
> > model-view-controller-based sites that use cookies, and for me is a
serious
> > bug.
> >
> > I've seen the problem on Tomcat 3.1 and 3.2b6. I'm running NT4.0 with
Sun
> > JDK 1.2.2. I would appreciate ideas on work-arounds or patches.
> >
>
> Colin,
>
> Are you saying that the *included* servlet is trying to set some
> headers/cookies, and they are not showing up? If so, that is the way it
is
> supposed to work. Servlet 2.2 Specification, section 8.3:
>
> The include method of the RequestDispatcher interface may be called
> at any time. The target servlet has access to all aspects of the
request
> object, but can only write information to the ServletOutputStream or
> Writer of the response object as well as the ability to commit a
response
> by either writing content past the end of the response buffer or
> explicitly calling the flush method of the ServletResponse interface.
> The included servlet cannot set headers or call any method that
affects
> the headers of the response. Any attempt to do so should be ignored.
>
> If this is not the situation you are describing, could you please provide
a bit
> more information?
>
>
> > Thanks!
> >
> > Colin Evans
> >
>
> Craig McClanahan
>
>
Re: RequestDispatcher breaks cookies, response headers
Posted by "Craig R. McClanahan" <Cr...@eng.sun.com>.
Colin Evans wrote:
> Hi, I believe I have found a bad bug in the RequestDispatcher
> implementation. If I do a successful RequestDispatcher.include() from one
> servlet to another, it appears that no HTTP response headers are returned
> except for "Content-Type". Everything else seems to respond correctly.
> "Location", "Content-Length", and "Servlet-Engine" headers as well as
> headers set in the servlet are not returned, and neither are any session or
> user cookies returned. This basically breaks all
> model-view-controller-based sites that use cookies, and for me is a serious
> bug.
>
> I've seen the problem on Tomcat 3.1 and 3.2b6. I'm running NT4.0 with Sun
> JDK 1.2.2. I would appreciate ideas on work-arounds or patches.
>
Colin,
Are you saying that the *included* servlet is trying to set some
headers/cookies, and they are not showing up? If so, that is the way it is
supposed to work. Servlet 2.2 Specification, section 8.3:
The include method of the RequestDispatcher interface may be called
at any time. The target servlet has access to all aspects of the request
object, but can only write information to the ServletOutputStream or
Writer of the response object as well as the ability to commit a response
by either writing content past the end of the response buffer or
explicitly calling the flush method of the ServletResponse interface.
The included servlet cannot set headers or call any method that affects
the headers of the response. Any attempt to do so should be ignored.
If this is not the situation you are describing, could you please provide a bit
more information?
> Thanks!
>
> Colin Evans
>
Craig McClanahan