Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-17188

[GSS](7.2.z) UNDERTOW-1575 - HttpServletRequest.getRequestedSessionID() is incorrectly returning a newly generated session ID instead of the requested ID in EAP 7 when using URL session tracking

    XMLWordPrintable

Details

    Description

      HttpServletRequest.getRequestedSessionID() is incorrectly returning a newly generated session ID instead of the requested ID in EAP 7 when using URL session tracking.

      Reproduction:

      It makes two calls to request.getRequestedSessionId(), one before creating a session and one after.
      These should both print null (since no jsessionid was passed on the URL). But instead the second prints the new ID.

      Or access http://localhost:8080/test/;jsessionid=test
      This should print "test" twice, but instead the second prints the new ID.

      The issue appears to be specific to URL session tracking, and was not reproduced when using COOKIE tracking.

      The issue is specific to EAP 7 and does not occur on EAP 6.

      Attachments

        1. test.war
          0.8 kB
        2. test.jsp
          0.4 kB
        3. test2.war
          0.9 kB

        Issue Links

          Activity

            People

              rhn-support-tmiyargi Teresa Miyar Gil (Inactive)
              rhn-support-ger-jan Gerhardus Johannes Petrus Maria te Dorsthorst
              Votes:
              0 Vote for this issue
              Watchers:
              12 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: