Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-17188

[GSS](7.2.z) UNDERTOW-1575 - HttpServletRequest.getRequestedSessionID() is incorrectly returning a newly generated session ID instead of the requested ID in EAP 7 when using URL session tracking

    Details

      Description

      HttpServletRequest.getRequestedSessionID() is incorrectly returning a newly generated session ID instead of the requested ID in EAP 7 when using URL session tracking.

      Reproduction:

      It makes two calls to request.getRequestedSessionId(), one before creating a session and one after.
      These should both print null (since no jsessionid was passed on the URL). But instead the second prints the new ID.

      Or access http://localhost:8080/test/;jsessionid=test
      This should print "test" twice, but instead the second prints the new ID.

      The issue appears to be specific to URL session tracking, and was not reproduced when using COOKIE tracking.

      The issue is specific to EAP 7 and does not occur on EAP 6.

        Gliffy Diagrams

          Attachments

          1. test.jsp
            0.4 kB
          2. test.war
            0.8 kB
          3. test2.war
            0.9 kB

            Issue Links

              Activity

                People

                • Assignee:
                  tmiyar Teresa Miyar Gil
                  Reporter:
                  gtedorst Ger-Jan te Dorsthorst
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  12 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: