You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@wicket.apache.org by Oliver Zemann <ol...@gmail.com> on 2013/04/04 09:04:53 UTC
Redirects to external URLs do not work as expected when cookies are forbidden
Hi
I created a wicket quickstart:
https://github.com/olze/WicketRedirect.git
The SC_SEE_OTHER which is defined in the RFC for HTTP 1.1 (iirc Jan. 1997)
was explaining that this should work (sending a post to the application
which uses GET to get the page from the redirected URL) is not working, it
says only 301 and 302 are allowed.
Why?
When using 301 it works as expected when cookies are disabled. When cookies
are disabled and 302 is used, it redirects to the local site and not to the
external one because of the missing Location header. Is this a bug or did i
understand something wrong? I thought 302 should be used when wicket should
redirect to an external URL.
Thanks
Oliver
Re: Redirects to external URLs do not work as expected when cookies
are forbidden
Posted by Martin Grigorov <mg...@apache.org>.
Please file a ticket in our Jira.
On Thu, Apr 4, 2013 at 5:03 PM, Oliver Zemann <ol...@gmail.com>wrote:
> 303 would execute a GET instead of POST on the new url. More over, i need
> *something* which works when cookies are rejected by the browser. I would
> prefer 302 but 302 does not work when cookies are disabled because wicket
> checks if its a temporarly or permanent move - if its permanent it sets the
> Location header, otherwise not (which makes troubles). And i still dont
> think this is jetty related. I will test this in a few days when i find
> some time on glassfish. As workaround i use 301 but i guess the customer
> will notice that and complain, because 301 has some impact on URLs
> (bookmarks, cache etc.) in the browser.
>
>
> 2013/4/4 Martin Grigorov <mg...@apache.org>
>
> > OK, I see
> >
> > public RedirectRequestHandler(final String redirectUrl, final int status)
> > {
> > if ((status != HttpServletResponse.SC_MOVED_PERMANENTLY) &&
> > (status != HttpServletResponse.SC_MOVED_TEMPORARILY))
> > {
> > throw new IllegalStateException("Status must be either 301 or 302, but
> was:
> > " + status);
> > }
> >
> > I'm not sure why there is such restriction. Maybe Igor can explain, git
> > blames him.
> >
> > What is your reason to use code 303 ? How its semantics are better than
> 302
> > in your case ?
> >
> >
> >
> > On Thu, Apr 4, 2013 at 4:35 PM, Oliver Zemann <oliver.zemann@gmail.com
> > >wrote:
> >
> > > But the warning is thrown by wicket itself that 303 is not allowed. So
> i
> > am
> > > very sure this is a wicket problem. I use jetty 9 as web server. So the
> > > problems with 301/302 could be related to jetty, but the not working
> 303
> > (i
> > > get that exception in wicket) is some kind of problem in wicket.
> > >
> > >
> > > 2013/4/4 Martin Grigorov <mg...@apache.org>
> > >
> > > > Hi,
> > > >
> > > > I'm not familiar with http code 303 (see other) but if there is a
> > problem
> > > > then you should ask in the forums of the used web container or web
> > > browser.
> > > > Wicket just sets response headers via Servlet APIs but the actual
> work
> > is
> > > > done by the container - to set the header, and by the browser - to
> read
> > > the
> > > > value and interpret it.
> > > >
> > > >
> > > > On Thu, Apr 4, 2013 at 10:04 AM, Oliver Zemann <
> > oliver.zemann@gmail.com
> > > > >wrote:
> > > >
> > > > > Hi
> > > > >
> > > > > I created a wicket quickstart:
> > > > > https://github.com/olze/WicketRedirect.git
> > > > >
> > > > > The SC_SEE_OTHER which is defined in the RFC for HTTP 1.1 (iirc
> Jan.
> > > > 1997)
> > > > > was explaining that this should work (sending a post to the
> > application
> > > > > which uses GET to get the page from the redirected URL) is not
> > working,
> > > > it
> > > > > says only 301 and 302 are allowed.
> > > > > Why?
> > > > >
> > > > > When using 301 it works as expected when cookies are disabled. When
> > > > cookies
> > > > > are disabled and 302 is used, it redirects to the local site and
> not
> > to
> > > > the
> > > > > external one because of the missing Location header. Is this a bug
> or
> > > > did i
> > > > > understand something wrong? I thought 302 should be used when
> wicket
> > > > should
> > > > > redirect to an external URL.
> > > > >
> > > > > Thanks
> > > > > Oliver
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Martin Grigorov
> > > > jWeekend
> > > > Training, Consulting, Development
> > > > http://jWeekend.com <http://jweekend.com/>
> > > >
> > >
> >
> >
> >
> > --
> > Martin Grigorov
> > jWeekend
> > Training, Consulting, Development
> > http://jWeekend.com <http://jweekend.com/>
> >
>
--
Martin Grigorov
jWeekend
Training, Consulting, Development
http://jWeekend.com <http://jweekend.com/>
Re: Redirects to external URLs do not work as expected when cookies
are forbidden
Posted by Oliver Zemann <ol...@gmail.com>.
303 would execute a GET instead of POST on the new url. More over, i need
*something* which works when cookies are rejected by the browser. I would
prefer 302 but 302 does not work when cookies are disabled because wicket
checks if its a temporarly or permanent move - if its permanent it sets the
Location header, otherwise not (which makes troubles). And i still dont
think this is jetty related. I will test this in a few days when i find
some time on glassfish. As workaround i use 301 but i guess the customer
will notice that and complain, because 301 has some impact on URLs
(bookmarks, cache etc.) in the browser.
2013/4/4 Martin Grigorov <mg...@apache.org>
> OK, I see
>
> public RedirectRequestHandler(final String redirectUrl, final int status)
> {
> if ((status != HttpServletResponse.SC_MOVED_PERMANENTLY) &&
> (status != HttpServletResponse.SC_MOVED_TEMPORARILY))
> {
> throw new IllegalStateException("Status must be either 301 or 302, but was:
> " + status);
> }
>
> I'm not sure why there is such restriction. Maybe Igor can explain, git
> blames him.
>
> What is your reason to use code 303 ? How its semantics are better than 302
> in your case ?
>
>
>
> On Thu, Apr 4, 2013 at 4:35 PM, Oliver Zemann <oliver.zemann@gmail.com
> >wrote:
>
> > But the warning is thrown by wicket itself that 303 is not allowed. So i
> am
> > very sure this is a wicket problem. I use jetty 9 as web server. So the
> > problems with 301/302 could be related to jetty, but the not working 303
> (i
> > get that exception in wicket) is some kind of problem in wicket.
> >
> >
> > 2013/4/4 Martin Grigorov <mg...@apache.org>
> >
> > > Hi,
> > >
> > > I'm not familiar with http code 303 (see other) but if there is a
> problem
> > > then you should ask in the forums of the used web container or web
> > browser.
> > > Wicket just sets response headers via Servlet APIs but the actual work
> is
> > > done by the container - to set the header, and by the browser - to read
> > the
> > > value and interpret it.
> > >
> > >
> > > On Thu, Apr 4, 2013 at 10:04 AM, Oliver Zemann <
> oliver.zemann@gmail.com
> > > >wrote:
> > >
> > > > Hi
> > > >
> > > > I created a wicket quickstart:
> > > > https://github.com/olze/WicketRedirect.git
> > > >
> > > > The SC_SEE_OTHER which is defined in the RFC for HTTP 1.1 (iirc Jan.
> > > 1997)
> > > > was explaining that this should work (sending a post to the
> application
> > > > which uses GET to get the page from the redirected URL) is not
> working,
> > > it
> > > > says only 301 and 302 are allowed.
> > > > Why?
> > > >
> > > > When using 301 it works as expected when cookies are disabled. When
> > > cookies
> > > > are disabled and 302 is used, it redirects to the local site and not
> to
> > > the
> > > > external one because of the missing Location header. Is this a bug or
> > > did i
> > > > understand something wrong? I thought 302 should be used when wicket
> > > should
> > > > redirect to an external URL.
> > > >
> > > > Thanks
> > > > Oliver
> > > >
> > >
> > >
> > >
> > > --
> > > Martin Grigorov
> > > jWeekend
> > > Training, Consulting, Development
> > > http://jWeekend.com <http://jweekend.com/>
> > >
> >
>
>
>
> --
> Martin Grigorov
> jWeekend
> Training, Consulting, Development
> http://jWeekend.com <http://jweekend.com/>
>
Re: Redirects to external URLs do not work as expected when cookies
are forbidden
Posted by Martin Grigorov <mg...@apache.org>.
OK, I see
public RedirectRequestHandler(final String redirectUrl, final int status)
{
if ((status != HttpServletResponse.SC_MOVED_PERMANENTLY) &&
(status != HttpServletResponse.SC_MOVED_TEMPORARILY))
{
throw new IllegalStateException("Status must be either 301 or 302, but was:
" + status);
}
I'm not sure why there is such restriction. Maybe Igor can explain, git
blames him.
What is your reason to use code 303 ? How its semantics are better than 302
in your case ?
On Thu, Apr 4, 2013 at 4:35 PM, Oliver Zemann <ol...@gmail.com>wrote:
> But the warning is thrown by wicket itself that 303 is not allowed. So i am
> very sure this is a wicket problem. I use jetty 9 as web server. So the
> problems with 301/302 could be related to jetty, but the not working 303 (i
> get that exception in wicket) is some kind of problem in wicket.
>
>
> 2013/4/4 Martin Grigorov <mg...@apache.org>
>
> > Hi,
> >
> > I'm not familiar with http code 303 (see other) but if there is a problem
> > then you should ask in the forums of the used web container or web
> browser.
> > Wicket just sets response headers via Servlet APIs but the actual work is
> > done by the container - to set the header, and by the browser - to read
> the
> > value and interpret it.
> >
> >
> > On Thu, Apr 4, 2013 at 10:04 AM, Oliver Zemann <oliver.zemann@gmail.com
> > >wrote:
> >
> > > Hi
> > >
> > > I created a wicket quickstart:
> > > https://github.com/olze/WicketRedirect.git
> > >
> > > The SC_SEE_OTHER which is defined in the RFC for HTTP 1.1 (iirc Jan.
> > 1997)
> > > was explaining that this should work (sending a post to the application
> > > which uses GET to get the page from the redirected URL) is not working,
> > it
> > > says only 301 and 302 are allowed.
> > > Why?
> > >
> > > When using 301 it works as expected when cookies are disabled. When
> > cookies
> > > are disabled and 302 is used, it redirects to the local site and not to
> > the
> > > external one because of the missing Location header. Is this a bug or
> > did i
> > > understand something wrong? I thought 302 should be used when wicket
> > should
> > > redirect to an external URL.
> > >
> > > Thanks
> > > Oliver
> > >
> >
> >
> >
> > --
> > Martin Grigorov
> > jWeekend
> > Training, Consulting, Development
> > http://jWeekend.com <http://jweekend.com/>
> >
>
--
Martin Grigorov
jWeekend
Training, Consulting, Development
http://jWeekend.com <http://jweekend.com/>
Re: Redirects to external URLs do not work as expected when cookies
are forbidden
Posted by Oliver Zemann <ol...@gmail.com>.
But the warning is thrown by wicket itself that 303 is not allowed. So i am
very sure this is a wicket problem. I use jetty 9 as web server. So the
problems with 301/302 could be related to jetty, but the not working 303 (i
get that exception in wicket) is some kind of problem in wicket.
2013/4/4 Martin Grigorov <mg...@apache.org>
> Hi,
>
> I'm not familiar with http code 303 (see other) but if there is a problem
> then you should ask in the forums of the used web container or web browser.
> Wicket just sets response headers via Servlet APIs but the actual work is
> done by the container - to set the header, and by the browser - to read the
> value and interpret it.
>
>
> On Thu, Apr 4, 2013 at 10:04 AM, Oliver Zemann <oliver.zemann@gmail.com
> >wrote:
>
> > Hi
> >
> > I created a wicket quickstart:
> > https://github.com/olze/WicketRedirect.git
> >
> > The SC_SEE_OTHER which is defined in the RFC for HTTP 1.1 (iirc Jan.
> 1997)
> > was explaining that this should work (sending a post to the application
> > which uses GET to get the page from the redirected URL) is not working,
> it
> > says only 301 and 302 are allowed.
> > Why?
> >
> > When using 301 it works as expected when cookies are disabled. When
> cookies
> > are disabled and 302 is used, it redirects to the local site and not to
> the
> > external one because of the missing Location header. Is this a bug or
> did i
> > understand something wrong? I thought 302 should be used when wicket
> should
> > redirect to an external URL.
> >
> > Thanks
> > Oliver
> >
>
>
>
> --
> Martin Grigorov
> jWeekend
> Training, Consulting, Development
> http://jWeekend.com <http://jweekend.com/>
>
Re: Redirects to external URLs do not work as expected when cookies
are forbidden
Posted by Martin Grigorov <mg...@apache.org>.
Hi,
I'm not familiar with http code 303 (see other) but if there is a problem
then you should ask in the forums of the used web container or web browser.
Wicket just sets response headers via Servlet APIs but the actual work is
done by the container - to set the header, and by the browser - to read the
value and interpret it.
On Thu, Apr 4, 2013 at 10:04 AM, Oliver Zemann <ol...@gmail.com>wrote:
> Hi
>
> I created a wicket quickstart:
> https://github.com/olze/WicketRedirect.git
>
> The SC_SEE_OTHER which is defined in the RFC for HTTP 1.1 (iirc Jan. 1997)
> was explaining that this should work (sending a post to the application
> which uses GET to get the page from the redirected URL) is not working, it
> says only 301 and 302 are allowed.
> Why?
>
> When using 301 it works as expected when cookies are disabled. When cookies
> are disabled and 302 is used, it redirects to the local site and not to the
> external one because of the missing Location header. Is this a bug or did i
> understand something wrong? I thought 302 should be used when wicket should
> redirect to an external URL.
>
> Thanks
> Oliver
>
--
Martin Grigorov
jWeekend
Training, Consulting, Development
http://jWeekend.com <http://jweekend.com/>