Hi,
I noticed some strange behavior on my webapplication that has authorization
in place (by using Roles).
It seems that Wicket creates a session for checking the role of the user
even the user has not logged in. I'd guess the preferred behavior would be
that wicket would in this occasion first check if there is a session and if
not, then just let the authorization fail instead of creating session and
then checking if role is there.
I did simple trace to find what is calling MySession constructor:
public MySession(final AuthenticatedWebApplication application,
final Request request) {
super(application, request);
this.logger.error("Created session", new Throwable());
}
18:56:16,634 (btpool0-5) ERROR [MySession] - Created session
java.lang.Throwable
at MySession.<init>(MySession.java:39)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
Method)
at
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
at
org.apache.wicket.authentication.AuthenticatedWebApplication.newSession(AuthenticatedWebApplication.java:114)
at org.apache.wicket.Session.findOrCreate(Session.java:225)
at org.apache.wicket.Session.findOrCreate(Session.java:208)
--
View this message in context:
http://www.nabble.com/Wicket-creating-a-session-for-authorization-even-if-no-user-signed-in-tp15717761p15717761.html
Sent from the Wicket - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
