mraible opened a new pull request, #248: URL: https://github.com/apache/roller/pull/248
While running a 7.0.0 snapshot against a copy of my site, I noticed every weblog page, feed and resource response carried a `Set-Cookie: JSESSIONID`. On 5.0.3 none of them did. The cause is `LoadSaltFilter`. It's mapped to `/roller-ui/*`, and since #167 it runs on `FORWARD` as well as `REQUEST`. Weblog requests are forwarded to the rendering servlets under `/roller-ui/rendering/`, so the filter runs for each one, calls `getSession(true)` and adds a salt to the cache. On a public site that means a session and a cache entry for every anonymous page view and every crawler request. The rendering servlets don't output any of Roller's own forms, so they have no use for a salt. This change makes the filter pass requests under `/roller-ui/rendering/` straight through. - Two new tests: a rendering path gets no session and no salt, and a path that merely starts with the same letters still gets both. - I also built the WAR and ran it: pages, feeds, resources and search no longer set a cookie, and `/roller-ui/login.rol` still does. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
