is your sign in page stateless? if its not it will need to be stored in session.
re ddos attacks, its really the job of the application server to
prevent an exorbitant amount of sessions opened from what looks like
the same ip or however it decides to do that. ie there are plenty of
jsp/struts applications that create a session on the first hit.
what wicket does is provide a page eviction strategy so once created
an attacker cannot grow the session infinitely
-igor
On Wed, Feb 27, 2008 at 11:10 AM, Roberto Fasciolo
<[EMAIL PROTECTED]> wrote:
>
> Our application is totally hidden behind authentication, so in our case the
> session (I'm talking about an object extending AuthenticatedWebSession) is
> created without any page navigation, just by opening the sign in page.
>
> Anyway, how can you deal with DoS attacks? I mean, it'll be really easy to
> write a small script continuously opening pages on a wicket site (or
> creating new sessions) until the site would die by OutOfMemoryError.
>
> But back in track, I don't see anything bad in, instead creating a new
> session just for calling getRoles() and getting null, returning directly
> null (= user not in any role) if the user never signed in before.
>
>
>
>
> igor.vaynberg wrote:
> >
> > wicket uses session to store pages, so creating a session is
> > orthogonal to authorizing/authenticating a user
> >
> > -igor
> >
> > On Wed, Feb 27, 2008 at 9:04 AM, Roberto Fasciolo
> > <[EMAIL PROTECTED]> wrote:
> >>
> >> Hi,
> >>
> >> I noticed some strange behavior on my webapplication that has
> >> authorization
> >> in place (by using Roles).
> >>
> >> It seems that Wicket creates a session for checking the role of the user
> >> even the user has not logged in. I'd guess the preferred behavior would
> >> be
> >> that wicket would in this occasion first check if there is a session and
> >> if
> >> not, then just let the authorization fail instead of creating session
> >> and
> >> then checking if role is there.
> >>
> >> I did simple trace to find what is calling MySession constructor:
> >>
> >> public MySession(final AuthenticatedWebApplication application,
> >> final Request request) {
> >> super(application, request);
> >> this.logger.error("Created session", new Throwable());
> >> }
> >>
> >> 18:56:16,634 (btpool0-5) ERROR [MySession] - Created session
> >> java.lang.Throwable
> >> at MySession.<init>(MySession.java:39)
> >> at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
> >> Method)
> >> at
> >>
> >>
> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
> >> at
> >>
> >>
> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
> >> at
> >> java.lang.reflect.Constructor.newInstance(Constructor.java:513)
> >> at
> >>
> >>
> org.apache.wicket.authentication.AuthenticatedWebApplication.newSession(AuthenticatedWebApplication.java:114)
> >>
> >> at org.apache.wicket.Session.findOrCreate(Session.java:225)
> >> at org.apache.wicket.Session.findOrCreate(Session.java:208)
> >> --
> >> View this message in context:
> >>
> http://www.nabble.com/Wicket-creating-a-session-for-authorization-even-if-no-user-signed-in-tp15717761p15717761.html
> >> Sent from the Wicket - User mailing list archive at Nabble.com.
> >>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: [EMAIL PROTECTED]
> >> For additional commands, e-mail: [EMAIL PROTECTED]
> >>
> >>
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: [EMAIL PROTECTED]
> > For additional commands, e-mail: [EMAIL PROTECTED]
> >
> >
> >
>
> --
> View this message in context:
> http://www.nabble.com/Wicket-creating-a-session-for-authorization-even-if-no-user-signed-in-tp15717761p15720619.html
>
>
> Sent from the Wicket - User mailing list archive at Nabble.com.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [EMAIL PROTECTED]
> For additional commands, e-mail: [EMAIL PROTECTED]
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
