Loading...

XML

Word

Printable

Type: Bug
Resolution: Done
Priority: Major
Fix Version/s: 2.3.14.Final, 2.2.33.Final
Affects Version/s: None
Component/s: Servlet
Labels:
None

Workaround:

Workaround Exists
Workaround Description:

Hide

Use POST in a FORM login page, not GET

Show
Use POST in a FORM login page, not GET
Git Pull Request:
https://github.com/undertow-io/undertow/pull/1607, https://github.com/undertow-io/undertow/pull/1608

If a FORM login page happens to use GET instead of the typical POST to send the login credentials to a custom location, then the short session timeout from ~~UNDERTOW-2378~~ / ~~UNDERTOW-2264~~ is still seen after login.

clones

UNDERTOW-2378 Adjust properly session timeout also in case when custom auth mechanisms are used

Resolved

is caused by

UNDERTOW-2264 CVE-2023-1973 SessionImpl objects + location strings are created and not cleaned up on authentication failures

Closed

is cloned by

JBEAP-27330 [GSS](8.0.z) UNDERTOW-2409 - Adjust properly session timeout also in case when GET requests with custom auth mechanisms are used

Open

is incorporated by

JBEAP-26990 [GSS](7.4.z) UNDERTOW-2409 / UNDERTOW-2378 - Adjust properly session timeout also in case when custom auth mechanisms are used

Ready for QA

WFCORE-6862 CVE-2024-6162 CVE-2024-27316 Upgrade Undertow to 2.3.14.Final

Resolved

is related to

JBEAP-27369 [GSS](8.0.z) UNDERTOW-2418 - Adjust properly session timeout also in case when FORM is combined with other mechanisms

JBEAP-27368 [GSS](7.4.z) UNDERTOW-2418 - Adjust properly session timeout also in case when FORM is combined with other mechanisms

Open

UNDERTOW-2418 Adjust properly session timeout also in case when FORM is combined with other mechanisms

Pull Request Sent

(3 is related to)

Assignee:: Richard Opalka

Reporter:: Aaron Ogburn

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Created:: 2024/06/18 7:45 PM

Updated:: 2024/06/27 2:08 PM

Resolved:: 2024/06/20 8:04 AM

Details

Description

Attachments

Issue Links

Activity

People

Dates