You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by gcollins <ga...@gmail.com> on 2012/03/13 01:23:39 UTC
Shiro Native Sessions - ";JSESSIONID" or "?JSESSIONID"?
Hello,
In my servlet I am encoding the next URL that the client should use in the
following way:
response.encodeURL(nextURL); // response is a HTTPServletResponse
This adds the JSESSIONID (of the Shiro session) on to the end of the URL
with a ";" separator.
Shiro, however, doesn't appear to be happy with this. I stepped through the
getReferencedSessionId method. Shiro could not find the JSESSIONID in the
response URL when the ";" separator is used.
If I change the ";" to "?" then everything works as expected.
So I guess my question is - is this the expected behaviour? Is only "?"
supported for Shiro? Should response.encodeURL be avoided for adding the
JSESSIONID to the URL?
If someone could help me out here, it would be a big help.
thanks in advance,
Gareth Collins
private Serializable getReferencedSessionId(ServletRequest request,
ServletResponse response) {
String id = getSessionIdCookieValue(request, response);
if (id != null) {
request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE,
ShiroHttpServletRequest.COOKIE_SESSION_ID_SOURCE);
} else {
//not in a cookie, or cookie is disabled - try the request
params as a fallback (i.e. URL rewriting):
id =
request.getParameter(ShiroHttpSession.DEFAULT_SESSION_ID_NAME); << GC: not
found here
if (id == null) {
//try lowercase:
id =
request.getParameter(ShiroHttpSession.DEFAULT_SESSION_ID_NAME.toLowerCase());
}
if (id != null) {
request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE,
ShiroHttpServletRequest.URL_SESSION_ID_SOURCE);
}
}
if (id != null) {
request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
//automatically mark it valid here. If it is invalid, the
//onUnknownSession method below will be invoked and we'll remove
the attribute at that time.
request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID,
Boolean.TRUE);
}
return id;
}
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Shiro-Native-Sessions-JSESSIONID-or-JSESSIONID-tp7367217p7367217.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Shiro Native Sessions - ";JSESSIONID" or "?JSESSIONID"?
Posted by manitas <ma...@gmail.com>.
Hi !
I use Tomcat 7 on my project and I have a problem related to this path
parameter.
If I want to access a restricted area it results on a redirection to the
following path
/login;JSESSIONID=xxx
The problem is that it leads to a 404 error page because /login page exists
but this path doesn't exist.
Today I use a filter as a workaround. It rewrites the uri transforming the
path parameter in http parameter.
Why not use directly a http parameter instead of a path parameter ?
Any idea for a clean solution ?
Thanks in advance fo your help.
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Shiro-Native-Sessions-JSESSIONID-or-JSESSIONID-tp7367217p7577460.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Shiro Native Sessions - ";JSESSIONID" or "?JSESSIONID"?
Posted by Les Hazlewood <lh...@apache.org>.
Hi Gareth,
Great catch - yes, we should fall back to checking path parameters if
the request param check fails. Please open a Jira!
Thanks,
Les
On Thu, Mar 22, 2012 at 9:11 PM, gcollins <ga...@gmail.com> wrote:
> Hello Les,
>
> I am using Jetty 7.5.4 (as part of Pax Web which is installed as part of
> Apache Karaf).
>
> Thanks for the Servlet 2.5 reference. So if Shiro is adding the JSESSIONID
> in a servlet compliant way, then then the code in the getReferencedSessionId
> method from org.apache.shiro.web.session.mgt.DefaultWebSessionManager
> appears incorrect (the full code sample is in my above post). The code for
> getting the session from the URL is this:
>
> //not in a cookie, or cookie is disabled - try the request
> params as a fallback (i.e. URL rewriting):
> id =
> request.getParameter(ShiroHttpSession.DEFAULT_SESSION_ID_NAME);
> if (id == null) {
> //try lowercase:
> id =
> request.getParameter(ShiroHttpSession.DEFAULT_SESSION_ID_NAME.toLowerCase());
> }
> .
> .
>
> request.getParameter() gets http parameters, not URL path parameters (like
> ";JSESSIONID=") so Shiro will always fail to extract the JSESSIONID. This
> link tends to suggest that there is no API in the Servlet spec which can
> extract URL path parameters. Instead the full path needs to be retrieved via
> getRequestURI() and the path parameter is then extracted manually:
>
> https://cdivilly.wordpress.com/2011/04/22/java-servlets-uri-parameters/
>
> Does this appear correct? Should I add the JIRA? I could even try and fix
> it...
>
> thanks in advance,
> Gareth
>
>
>
>
>
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/Shiro-Native-Sessions-JSESSIONID-or-JSESSIONID-tp7367217p7397601.html
> Sent from the Shiro User mailing list archive at Nabble.com.
Re: Shiro Native Sessions - ";JSESSIONID" or "?JSESSIONID"?
Posted by gcollins <ga...@gmail.com>.
Hello Les,
I am using Jetty 7.5.4 (as part of Pax Web which is installed as part of
Apache Karaf).
Thanks for the Servlet 2.5 reference. So if Shiro is adding the JSESSIONID
in a servlet compliant way, then then the code in the getReferencedSessionId
method from org.apache.shiro.web.session.mgt.DefaultWebSessionManager
appears incorrect (the full code sample is in my above post). The code for
getting the session from the URL is this:
//not in a cookie, or cookie is disabled - try the request
params as a fallback (i.e. URL rewriting):
id =
request.getParameter(ShiroHttpSession.DEFAULT_SESSION_ID_NAME);
if (id == null) {
//try lowercase:
id =
request.getParameter(ShiroHttpSession.DEFAULT_SESSION_ID_NAME.toLowerCase());
}
.
.
request.getParameter() gets http parameters, not URL path parameters (like
";JSESSIONID=") so Shiro will always fail to extract the JSESSIONID. This
link tends to suggest that there is no API in the Servlet spec which can
extract URL path parameters. Instead the full path needs to be retrieved via
getRequestURI() and the path parameter is then extracted manually:
https://cdivilly.wordpress.com/2011/04/22/java-servlets-uri-parameters/
Does this appear correct? Should I add the JIRA? I could even try and fix
it...
thanks in advance,
Gareth
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Shiro-Native-Sessions-JSESSIONID-or-JSESSIONID-tp7367217p7397601.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Shiro Native Sessions - ";JSESSIONID" or "?JSESSIONID"?
Posted by Les Hazlewood <lh...@apache.org>.
Hi Gareth,
A semicolon is referenced as an example query delimiter in the Servlet
2.5 specification, section 7.1.3.
Could it be that your container does not support ';' as a query
delimiter? What container are you using?
Regards,
Les
On Wed, Mar 21, 2012 at 7:23 PM, gcollins <ga...@gmail.com> wrote:
> Anyone? This appears to be a (quite serious) bug...if Shiro wants a HTTP
> parameter (i.e. ?JSESSIONID") it should be adding JSESSIONID as a HTTP
> parameter in the encodeURL method.
>
> Of course I could be missing something obvious. If someone could tell me
> what I am missing or confirm this is a defect, it would be much appreciated.
> If it is a defect I will add a JIRA ticket.
>
> thanks in advance,
> Gareth
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/Shiro-Native-Sessions-JSESSIONID-or-JSESSIONID-tp7367217p7394217.html
> Sent from the Shiro User mailing list archive at Nabble.com.
Re: Shiro Native Sessions - ";JSESSIONID" or "?JSESSIONID"?
Posted by gcollins <ga...@gmail.com>.
Anyone? This appears to be a (quite serious) bug...if Shiro wants a HTTP
parameter (i.e. ?JSESSIONID") it should be adding JSESSIONID as a HTTP
parameter in the encodeURL method.
Of course I could be missing something obvious. If someone could tell me
what I am missing or confirm this is a defect, it would be much appreciated.
If it is a defect I will add a JIRA ticket.
thanks in advance,
Gareth
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Shiro-Native-Sessions-JSESSIONID-or-JSESSIONID-tp7367217p7394217.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Shiro Native Sessions - ";JSESSIONID" or "?JSESSIONID"?
Posted by gcollins <ga...@gmail.com>.
I did some more research on this. I see that the ShiroHTTPServletResponse is
the one that sets the JSESSIONID using ";" (rather than the base
HttpServletResponse), which is weird as Shiro is expecting "?" on subsequent
requests. Is there something I am missing here?
thanks in advance,
Gareth
/**
* Encode the session identifier associated with this response
* into the specified URL, if necessary.
*
* @param url URL to be encoded
*/
public String encodeURL(String url) {
String absolute = toAbsolute(url);
if (isEncodeable(absolute)) {
// W3c spec clearly said
if (url.equalsIgnoreCase("")) {
url = absolute;
}
return toEncoded(url, request.getSession().getId());
} else {
return url;
}
}
protected String toEncoded(String url, String sessionId) {
if ((url == null) || (sessionId == null))
return (url);
String path = url;
String query = "";
String anchor = "";
int question = url.indexOf('?');
if (question >= 0) {
path = url.substring(0, question);
query = url.substring(question);
}
int pound = path.indexOf('#');
if (pound >= 0) {
anchor = path.substring(pound);
path = path.substring(0, pound);
}
StringBuilder sb = new StringBuilder(path);
if (sb.length() > 0) { // session id param can't be first.
sb.append(";");
sb.append(DEFAULT_SESSION_ID_PARAMETER_NAME);
sb.append("=");
sb.append(sessionId);
}
sb.append(anchor);
sb.append(query);
return (sb.toString());
}
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Shiro-Native-Sessions-JSESSIONID-or-JSESSIONID-tp7367217p7368935.html
Sent from the Shiro User mailing list archive at Nabble.com.