Loading...

XML

Word

Printable

Type: Bug
Resolution: Unresolved
Priority: Critical
Fix Version/s: None
Affects Version/s: 7.4.17.GA
Component/s: Undertow
Labels:
None

Blocked:
False
Blocked Reason:
None
Ready:
False
CDW devel_ack:
CDW docs_ack:
CDW pm_ack:
CDW qa_ack:
CDW release:
Target Release:

7.backlog.GA
Git Pull Request:
https://github.com/undertow-io/undertow/pull/1635
Intelligence Requested:
Market:

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

If the FORM mechanism is used in conjunction with another, then the short session timeout from ~~UNDERTOW-2378~~ / ~~UNDERTOW-2264~~ is still seen after login. This is because the FORM mech will set its short timeout through the challenge phase, but it is not guaranteed that ServletFormAuthenticationMechanism.authenticate will be called. The client may authenticate with one of the other available mechanisms, leaving the short session timeout.

- - Sort By Name
  - Sort By Date
  - Ascending
  - Descending
  - Thumbnails
  - List
  - Download All

UNDERTOW-2418reproducer.tar.xz
22 kB
2024/06/27 2:05 PM

clones

UNDERTOW-2418 Adjust properly session timeout also in case when FORM is combined with other mechanisms

Pull Request Sent

is caused by

UNDERTOW-2264 CVE-2023-1973 SessionImpl objects + location strings are created and not cleaned up on authentication failures

Closed

is cloned by

JBEAP-27369 [GSS](8.0.z) UNDERTOW-2418 - Adjust properly session timeout also in case when FORM is combined with other mechanisms

relates to

UNDERTOW-2409 Adjust properly session timeout also in case when GET requests with custom auth mechanisms are used

Resolved

Assignee:: Flavia Rainone

Reporter:: Aaron Ogburn

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Created:: 2024/06/27 2:05 PM

Updated:: 2024/06/27 2:10 PM

Details

Description

Attachments

Attachments

Issue Links

Activity

People

Dates