Hi

I have a problem with my configuration and I wonder if anybody could
help me. We have got a small subnetwork where host AAA is our webserver
running Apache/Jserv. The configuration of the domain we are subdomain of,
says that each request to our domain (say xxx.yyy.de) ist routed to
AAA.xxx.yyy.de. Thus, someone can connect my webserver by just typing
http://xxx.yyy.de/index.html. Local links can also be written this way.

I also have a servlet zone db, where the main servlet is main, so a
request http://xxx.yyy.de/db/main starts the servlet main. This works
fine. Now, I want to redirect the client in main's doPost method to
servlet serv1.

    URL thisURL=new URL(HttpUtils.getRequestURL(req).toString());
    String encodedRedirectURL=
         res.encodeRedirectUrl("http://"+thisURL.getHost()+"/db/serv1");
    res.sendRedirect(encodeRedirectURL);

This way, the client is directed to http://AAA.xxx.yyy.de/?JServSessionId[...]
,where the url contains the hostname. If the URL consists of the domainname only,

    String encodedRedirectURL=
         res.encodeRedirectUrl("http://xxx.yyy.de/db/serv1");
    res.sendRedirect(encodeRedirectURL);

the sessions is lost, if the client does not support cookies,
because the encodedRedirectURL does not contain the JServSessionId.

Is this a security issue or just a wrong configuration of apache/jserv
which runs as nobody (started by root). By the way, if I append
thisURL.getPort() after thisURL.getHost() the port is -1 instead of
80.

Thank you for any help

Oliver

___________________________________________________________________________
To unsubscribe, send email to [EMAIL PROTECTED] and include in the body
of the message "signoff SERVLET-INTEREST".

Archives: http://archives.java.sun.com/archives/servlet-interest.html
Resources: http://java.sun.com/products/servlet/external-resources.html
LISTSERV Help: http://www.lsoft.com/manuals/user/user.html

Reply via email to