Sven Meier commented on WICKET-6432:

With remember-me out of the way we come to the core of the problem (and It 
doesn't depend whether you have set 
"org.eclipse.jetty.servlet.SessionIdPathParameterName" or not):

Jetty restricts the session cookie to HTTPS requests only. Any further request 
via HTTP has to include another Session cookie *in* the URL.

These are measures by Jetty to limit access to a session cookie to secure 
connections. I don't see what Wicket can do about this. Suggestions are 

> SignInPanel causes infinite redirect loop if session id is suppressed in URL
> ----------------------------------------------------------------------------
>                 Key: WICKET-6432
>                 URL: https://issues.apache.org/jira/browse/WICKET-6432
>             Project: Wicket
>          Issue Type: Bug
>          Components: wicket-auth-roles
>    Affects Versions: 7.8.0
>            Reporter: Simon Erhardt
>            Assignee: Martin Grigorov
>         Attachments: redirect-loop.zip
> The attached, very simple quickstart causes an infinite redirection loop. It 
> consists of a _AuthenticatedPage_, which is annotated by 
> _@AuthorizeInstantiation_, and a _LoginPage_, using a SingInPanel, which is 
> set up as home page.
> The trouble begins if one opens the HTTP URL after signing in with HTTPS.
> It happens only if Jetty is forced to suppress the session id as URL 
> parameter (see [Jetty 9.2.X 
> documentation|http://www.eclipse.org/jetty/documentation/9.2.22.v20170531/session-management.html#setting-session-characteristics]):
> {code}
>     WebAppContext bb = new WebAppContext();
>     // The following line causes the trouble
> bb.setInitParameter("org.eclipse.jetty.servlet.SessionIdPathParameterName", 
> "none");
> {code}
> Steps to reproduce:
> # Start the application in test/java/quickstart/Start
> # Open https://localhost:8443
> # Sign in using "user" and "password"
> # After redirected to the AuthenticatedPage, open http://localhost:8080

This message was sent by Atlassian JIRA

Reply via email to