DO NOT REPLY [Bug 10229] New: - Request parameters lost after authenticated through login page

[bugzilla]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10229>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10229

Request parameters lost after authenticated through login page

           Summary: Request parameters lost after authenticated through
                    login page
           Product: Tomcat 4
           Version: 4.0.3 Final
          Platform: PC
        OS/Version: Windows NT/2K
            Status: NEW
          Severity: Blocker
          Priority: Other
         Component: Catalina
        AssignedTo: [EMAIL PROTECTED]
        ReportedBy: [EMAIL PROTECTED]


I have a web appplication which declares the security contraint in web.xml file
so that when a request such as
"https://localhost:8443/context/someservlet?param1=x&param2=y"; is sent from the
browser, the server returns with loginpage to ask client to authenticate.

When the client is authenticated, the request parameters seem to be lost.
someservlet can't find param1 or param2.

But if I submit the same request again from the browser during the same session,
the  parameters can be picked up by someservlet. 

The security-contraint is defined as the following:
        <security-constraint>
                <web-resource-collection>
                        <web-resource-name></web-resource-name>
                        <url-pattern>/someservlet</url-pattern>
                </web-resource-collection>
                <auth-constraint>
                        <role-name>role1</role-name>
                        <role-name>role2</role-name>
                </auth-constraint>
                <user-data-constraint>
                        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
                </user-data-constraint>
        </security-constraint>
    <login-config>
      <auth-method>FORM</auth-method>
        <form-login-config>
          <form-login-page>/loginpage.jsp</form-login-page>
          <form-error-page>/errorpage.jsp</form-error-page>
        </form-login-config>
    </login-config>

--
To unsubscribe, e-mail:   <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>