Duplicate ? [Bug 10899] = 10711

2002-07-17 Thread Henner Zeller
ReportedBy: [EMAIL PROTECTED] > > > The relative url can't be converted to absolute url. > I think it's useful. -- Henner Zeller Dipl.-Inform. Med. freiheit.com technologies gmbh Theodorstr. 42-90 / 22761 Hamburg, Germany fon +49 (0)40 / 890584-0 fax +49 (0)40 / 890584

Re: [Bug 10419] - Session-ID grabbing from Request accepts invalidsession cookies in presense of valid URL sessions

2002-07-03 Thread Henner Zeller
Even if - it would be good if the server would be robust in that case, right ? ciao, -hen -- Henner Zeller Dipl.-Inform. Med. freiheit.com technologies gmbh Theodorstr. 42-90 / 22761 Hamburg, Germany fon +49 (0)40 / 890584-0 fax +49 (0)40 / 890584-20 -- To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]> For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>

Re: [Bug 10419] - Session-ID grabbing from Request accepts invalidsession cookies in presense of valid URL sessions

2002-07-03 Thread Henner Zeller
Hi, > If you want the *current* session for this request, you should always call > request.getSession() instead. Yes. This is correctly working in tomcat 3.x: the getRequestedSessionId() returns one of the IDs with preference to the cookie; the getSession() returns the current session. perfect

Re: [Bug 10419] - Session-ID grabbing from Request accepts invalidsession cookies in presense of valid URL sessions

2002-07-03 Thread Henner Zeller
Hi, > > We always have the problem, that we might get multiple session ids (from > > the URL, from _multple_ cookies). > > You should not be getting multiple session id cookies for different > webapps unless (a) the context paths overlap, or (b) your client is not > following the rules of the sp

Re: [Bug 10419] - Session-ID grabbing from Request accepts invalidsession cookies in presense of valid URL sessions

2002-07-03 Thread Henner Zeller
Hi, [- this disucsses Bug 10419 and 10418. See details in http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10419 and http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10418 with a bug-demonstration servlet http://www.freiheit.com/users/hzeller/SessionBugDemonstration.java this works

Re: Valves, requests and getting the session

2002-07-01 Thread Henner Zeller
Hi, > Yes, I am. I need to check to see if certain objects are in the session and if > not, see if they are in another session that is pointed to by the Cookie id. > It's like SingleSignOn, but slightly different. However I'm a bit confused to > why I can't get a session, even when the rest of

4.0/4.1: Session handling without cookies broken

2002-07-01 Thread Henner Zeller
Hi Guys, I recently had the pleasure to work more with web applications and am now finding my way back to the server source. First impression: tomcat grew big, compared to JServ times .. but it seems, that its actual main aim, being a small, robust and fast servlet engine - isn't as dominant