Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (athena.apache.org: local policy)
Message-ID: <484FF92A.9020802@ice-sa.com>
Date: Wed, 11 Jun 2008 18:11:22 +0200
From: =?UTF-8?B?QW5kcsOpIFdhcm5pZXI=?= <aw@ice-sa.com>
User-Agent: Thunderbird 1.5 (Windows/20051201)
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: Moving from a very old Tomcat to a new Tomcat.
References: <4837459D.3030704@seatadvisor.com> <48374AEC.8020906@cornell.edu>
 <48374CAB.2020507@seatadvisor.com> <483C14BE.2000007@christopherschultz.net>
 <484872A1.8090000@seatadvisor.com> <484882F3.708@seatadvisor.com>
 <484D5704.2000200@christopherschultz.net> <484DF0AE.2010703@SeatAdvisor.com>
 <484ED601.6040108@christopherschultz.net> <484ED801.1000002@seatadvisor.com>
 <484EDA35.9010701@christopherschultz.net> <484F9527.2050305@ice-sa.com>
 <484FD516.30501@christopherschultz.net>
In-Reply-To: <484FD516.30501@christopherschultz.net>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit


Christopher Schultz wrote:
[...]

> | (And, as a secondary question, what does one exactly put in it then, so
> | that it still matches the "session key" ? Or can you just put something
> | arbitrary in it, and Tomcat will use whatever is there to identify the
> | session data store ?)
> 
> The cookie must be called JSESSIONID, and the value must be the id of
> the session. So, you can just do something like this:
> 
> response.addCookie(new Cookie("JSESSIONID",
> ~                   request.getSession().getId());
> 
Christopher Schultz (also) wrote:
> 
> Tomcat generates the cookie the first time you call
> HttpServletRequest.getSession(true) and the session is actually created.
> 

I'm possibly nitpicking, but still trying to get a full crash-proof 
explanation :

Imagine the following scenario (and sorry if some of the terms I'm using 
are not the official ones) :

A servlet context consists of a servlet (code), and a context descriptor 
(web.xml) which points to this servlet code, and also establishes a 
"security context" (in other words says that access to this servlet is 
subject to certain criteria).
A browser sends a request for this servlet context.  Tomcat receives the 
request, and determines that it needs authentication.
At this point, the code of the servlet has not yet been invoked, so 
there has been no opportunity for the servlet to call 
HttpServletRequest.getSession().
(true/false ?)
So according to the above, neither the session nor the JSESSIONID cookie 
have yet been created.
(true/false ?)
Since there is no session, there is no stored user-id, and Tomcat sends 
back a 401 response (or a login form, depending).
There cannot be a JSESSIONID cookie in this server response, because no 
session exists yet.
The user authenticates, the authentication is checked, and now by some 
mechanism the call is redirected to the originally-requested URL.
But still according to the above, there is no session yet, because 
HttpServletRequest.getSession() has still not been called.

But Tomcat must be able to retrieve the authenticated user-id somewhere, 
before allowing the servlet code to be executed.  So if there is no 
session yet, where does it get it ?

The above cannot all be correct, there is a contradiction somewhere.  Or 
is it just me being thick ?


(I also have a problem with the 
HttpServletRequest.isRequestedSessionIdValid() call, because I fail to 
see a case where the return value would be false.  But I'll get to that 
one later, if I haven't exhausted everyone's patience by then.)

André

---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org