Duplicate ? [Bug 10899] = 10711

2002-07-17 Thread Henner Zeller
] ReportedBy: [EMAIL PROTECTED] The relative url can't be converted to absolute url. I think it's useful. -- Henner Zeller Dipl.-Inform. Med. freiheit.com technologies gmbh Theodorstr. 42-90 / 22761 Hamburg, Germany fon +49 (0)40 / 890584-0 fax +49 (0)40 / 890584-20 -- To unsubscribe, e-mail

Re: [Bug 10419] - Session-ID grabbing from Request accepts invalidsession cookies in presense of valid URL sessions

2002-07-03 Thread Henner Zeller
Hi, [- this disucsses Bug 10419 and 10418. See details in http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10419 and http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10418 with a bug-demonstration servlet http://www.freiheit.com/users/hzeller/SessionBugDemonstration.java this

Re: [Bug 10419] - Session-ID grabbing from Request accepts invalidsession cookies in presense of valid URL sessions

2002-07-03 Thread Henner Zeller
Hi, We always have the problem, that we might get multiple session ids (from the URL, from _multple_ cookies). You should not be getting multiple session id cookies for different webapps unless (a) the context paths overlap, or (b) your client is not following the rules of the specs.

Re: [Bug 10419] - Session-ID grabbing from Request accepts invalidsession cookies in presense of valid URL sessions

2002-07-03 Thread Henner Zeller
Hi, If you want the *current* session for this request, you should always call request.getSession() instead. Yes. This is correctly working in tomcat 3.x: the getRequestedSessionId() returns one of the IDs with preference to the cookie; the getSession() returns the current session. perfect.

Re: [Bug 10419] - Session-ID grabbing from Request accepts invalidsession cookies in presense of valid URL sessions

2002-07-03 Thread Henner Zeller
-- Henner Zeller Dipl.-Inform. Med. freiheit.com technologies gmbh Theodorstr. 42-90 / 22761 Hamburg, Germany fon +49 (0)40 / 890584-0 fax +49 (0)40 / 890584-20 -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]

4.0/4.1: Session handling without cookies broken

2002-07-01 Thread Henner Zeller
Hi Guys, I recently had the pleasure to work more with web applications and am now finding my way back to the server source. First impression: tomcat grew big, compared to JServ times .. but it seems, that its actual main aim, being a small, robust and fast servlet engine - isn't as dominant

Re: Valves, requests and getting the session

2002-07-01 Thread Henner Zeller
Hi, Yes, I am. I need to check to see if certain objects are in the session and if not, see if they are in another session that is pointed to by the Cookie id. It's like SingleSignOn, but slightly different. However I'm a bit confused to why I can't get a session, even when the rest of