DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=12515>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=12515

bean:include doesnt seem to pass on session information in Jetty 4.01

[EMAIL PROTECTED] changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |WONTFIX



------- Additional Comments From [EMAIL PROTECTED]  2002-10-13 01:18 -------
The <bean:include> tag unconditionally performs a separate HttpURLConnection
request to the requested resource.  It is risky to attempt a determination of
whether the destination URL is part of the same webapp or not, so the tag is
conservative and never includes the session id -- resulting in the behavior you
see.  To avoid creating a security hole, this behavior will not be changed.

A possible workaround for you, if you're running on a Servlet 2.3 / JSP 1.2
platform, is to use the JSTL <c:import> tag.  This tag has special logic for
intra-webapp URLs and uses a RequestDispatcher.include() call in those
circumstances, which means the include will be part of the same request (and
therefore the same session).  As an added bonus, it will also execute a little
faster.

--
To unsubscribe, e-mail:   <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>

Reply via email to