I have seen this problem as well. I searched here for it after we discovered the problem, because I wanted to see if it had been discussed before.
What I am seeing, using live bookmarks plugin for firefox, is that the browser is redirected back to your service from CAS, then the mod_auth_cas cookie gets sent to the browser. But, before the browser caches the cookie, the requests for images, video, or other media, is sent WITHOUT the mod_auth_cas cookie. So, the first request to that service does not render css, images, video, etc. The reason this happens is that the browser does not know how to handle a javascript redirection for media types other than html. So, instead of using the following javascript redirection, <script> window.location.href="<%= service %>"; </script> We switched it to... response.sendRedirect(service); I believe this sends a 303 ( haven't checked), which is what the purpose for that response code is. Before trying it agian, make sure you 1. delete mod_auth_cas cookies 2. logout of cas 3. clear your browser cache. So, my big question is, why is response.sendRedirect() not used by default? Is there some adverse behaviour with certain browsers or something? Trenton D. Adams Systems Analyst/Web Software Engineer Navy Penguins at your service! Athabasca University (780) 675-6195 :wq! ----- "Peter C CIV SPAWAR SSC PAC Thung, 56340" <[email protected]> wrote: > From: "Peter C CIV SPAWAR SSC PAC Thung, 56340" <[email protected]> > To: [email protected] > Cc: [email protected], "matt smith" <[email protected]> > Sent: Monday, February 23, 2009 2:35:16 PM GMT -07:00 US/Canada Mountain > Subject: [cas-dev] Questioning Regarding mod_cas and mod_auth_cas > > Message In regards to the following: mod_auth_cas http://www.ja-sig.org/wiki/display/CASC/mod_auth_cas mod_cas http://www.ja-sig.org/wiki/display/CASC/MOD_CAS After reading the description of the two I came across this in regards to teh mod_cas client. When not to use MOD_CAS > (Per Scott Lundgren's email). mod_cas not should not be used with pages that use frames > directories of images files should be moved out from under mod_cas protection > because browsers (IE 6 & Firefox 1.06) do not know how to handle the > redirects for the requests for images embedded in an HTML page > directories of CSS files should be moved out from under mod_cas protection > for the same reasons > mod_cas cannot be used with server generated images where scripts return an > image stream > In our particular website, it does use frames and does have embedded images in HTML pages. Apparently it does not have any issues using regular Basic Authentication using the built in mod_auth directive. Does anyone know if any of these mod_cas issues were addressed in the mod_auth_cas implementation? Anyone have any idea if it is even possible to address this issues given the CAS architecture and hence why there was a cautionary note on MOD_CAS? Thanks. -Peter > ****************************************************************** Peter Thung SPAWAR Systems Center PACIFIC (Code 56340) Netcentric ISR Development Software Developer Primary: (619) 553-6513 Secondary:(619) 553-0777 ****************************************************************** > -- > You are currently subscribed to [email protected] as: > [email protected] > To unsubscribe, change settings or access archives, see > http://www.ja-sig.org/wiki/display/JSG/cas-dev __ This communication is intended for the use of the recipient to whom it is addressed, and may contain confidential, personal, and or privileged information. Please contact us immediately if you are not the intended recipient of this communication, and do not copy, distribute, or take action relying on it. Any communications received in error, or subsequent reply, should be deleted or destroyed. --- -- You are currently subscribed to [email protected] as: [email protected] To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
