[Bug 69815] Feature request: support device bound session credentials (DBSC)

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=69815

Mark Thomas <ma...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |enhancement

--- Comment #1 from Mark Thomas <ma...@apache.org> ---
A quick review suggests this is not generally implementable on a Servlet
container.

The protocol assumes that sessions are never scoped more narrowly than per
origin. That is not the case for a Servlet container where sessions are scoped
per web application which is (nearly) always more narrow than the origin.

You could implement this if it were limited to the ROOT context. That may or
may not be useful.

My sense is that this is still experimental and that it is too early to think
about a Tomcat implementation.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org