Re: How does one control what the path is on the JSESSIONID cookie?

2009-06-24 Thread John Caron
Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 John, On 6/23/2009 5:04 PM, John Caron wrote: Pid wrote: Filip Hanik - Dev Lists wrote: John Caron wrote: Tomcat 6.0.18 automatically adds the session cookie like: Set-Cookie

Re: How does one control what the path is on the JSESSIONID cookie?

2009-06-23 Thread John Caron
Pid wrote: Filip Hanik - Dev Lists wrote: John Caron wrote: Tomcat 6.0.18 automatically adds the session cookie like: Set-Cookie: JSESSIONID=6D839FF3B960947CC6FD41B98CD02E0D; Path=/thredds How can I change the path part of the cookie? the only thing you can do is set

How does one control what the path is on the JSESSIONID cookie?

2009-06-22 Thread John Caron
Tomcat 6.0.18 automatically adds the session cookie like: Set-Cookie: JSESSIONID=6D839FF3B960947CC6FD41B98CD02E0D; Path=/thredds How can I change the path part of the cookie? thanks... - To unsubscribe, e-mail:

Obtain a SocketChannel instead of OutputStream ?

2008-02-05 Thread John Caron
My application is a scientific data server that transfers large amounts of binary data. I am looking to make it as fast as possible and have been experimenting with the NIO FileChannel.transferTo() method. This appears to be much faster (3-10X) than using an OutputStream, under some

Re: Is compress working? No Content-Encoding header

2007-12-20 Thread John Caron
It seems bizarre, but it appears that the Accept-Encoding header is being lost somewhere on route from my home computer. running this test on my work computer works fine. sorry for the noise. Caldarale, Charles R wrote: From: John Caron [mailto:[EMAIL PROTECTED] Subject: Is compress working

Is compress working? No Content-Encoding header

2007-12-09 Thread John Caron
I tried to enable compression in Tomcat 6.0.10: Connector port=9080 protocol=HTTP/1.1 maxThreads=50 connectionTimeout=2 redirectPort=9443 compression=on compressableMimeType=text/html,text/xml,text/plain,application/xml,application/octet-stream,application/x-netcdf

Re: session hijacking again

2007-01-30 Thread John Caron
Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 John, John Caron wrote: We plan on using SSL to do the initial authentication, but then use session ids without SSL for the data transfer. Okay, thanks for clarifying that. This is definitely a good thing to do

session hijacking again

2007-01-26 Thread John Caron
or pointers (or code!) to get started. Thanks for any help. John Caron Unidata/UCAR - To start a new topic, e-mail: users@tomcat.apache.org To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]

Re: Bypass web.xml declarative security (sort of)

2007-01-18 Thread John Caron
thank you, I will investigate securityfilter Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 John, John Caron wrote: Instead of declaring which URLs need to be secure in web.xml, I would like to determine this when the URL comes in, but then use Tomcat to deal

how to tell Tomcat to send a blank WWW-Authenticate header?

2007-01-17 Thread John Caron
Christopher Schultz wrote: Also, you could set the error page that is used when a user doesn't have the proper credentials to something that gives you the opportunity to re-login in order to access the forbidden resource. When you want to log someone out of BASIC authentication, you have to

Bypass web.xml declarative security (sort of)

2007-01-17 Thread John Caron
Hello: Instead of declaring which URLs need to be secure in web.xml, I would like to determine this when the URL comes in, but then use Tomcat to deal with the authentication if it is needed. Can anyone give me any pointers on where to get started with that? thanks, John Caron

Re: Programmatic Security

2006-06-30 Thread John Caron
Nicholas Sushkin wrote: On Wednesday 28 June 2006 14:05, John Caron wrote: I assume I need to get a session established, so that the authorization need only be done once. It would also be nice if I recieve a unauthorized request, that I could pass it to Tomcat's 401 challenge

Re: Programmatic Security

2006-06-28 Thread John Caron
. - Original Message - From: John Caron [EMAIL PROTECTED] To: Tomcat Users List users@tomcat.apache.org Sent: Tuesday, June 27, 2006 9:01 PM Subject: Programmatic Security I need to implement fine-grained security access, so it looks to me like Programmatic Security (Servlet spec 12.3) is called

Programmatic Security

2006-06-27 Thread John Caron
I need to implement fine-grained security access, so it looks to me like Programmatic Security (Servlet spec 12.3) is called for. I want to recieve the request in my servlet, then decide what access rights are needed for it. In this case, if I understand correctly, the user must already be