You can either call setResponsePage or throw a RestartResponseException.
I think the main reason for implementing this is security. Since it's
handled through the session, the user cannot tamper with the url.
Of course it's also very easy to use.
Furthermore it's very easy to implement by a wicket user in the exact
way he/she needs it.
Op 9-12-2011 13:19, schreef Nazaret Kazarian:
Thanks for the quick reply. That's what I was thinking to do, from a
high level perspective, but could anyone provide some more details
regarding the implementation?
First of all, how do I redirect the user and avoid the creation of a
session? Just call Component.setResponsePage?
This seems as if I am trying to implement an alternative of
PageMap.redirectToInterceptPage without a session. So, why
redirectToInterceptPage was implemented requiring an HttpSession?
What't the trade off of not requiring the HttpSession (apart from the
obvious effort needed to save the original URL client side, and then
retrieve it through a request parameter)?
Any insight into this would be great!!
Thanks
2011/12/9 Bas Gooren<[email protected]>:
Hi,
It's certainly possible, with some additional work by you.
The easiest way:
- redirect the user to your login page, add a variable to the PageParameters
which helps you redirect them back
- after logging in, check for said variable in PageParameters and redirect
the user back
Now the easiest way is to simply put the current url in PageParameters; If
you do so, I'd make sure you check the url though, to prevent users from
being redirected to another website.
Op 9-12-2011 12:47, schreef Nazaret Kazarian:
Hi there,
I am using Wicket 1.4.19 and trying to do what the subject says: Avoid
creating an HttpSession before the user logs in. Why would I want to
allocate memory for an unauthorized user, right?
I can make my login page stateless and if the user hits the login page
URL no session is created yet
(https://cwiki.apache.org/WICKET/stateless-pages.html). So far so
good.
BUT: If the user hits any other URL (such as the context root), she is
redirected to the login page and the redirect creates an HttpSession!
This is because onUnauthorizedInstantiation we throw a new
RestartResponseAtInterceptPageException(LoginPage.class), which sets
up a redirect through the page map, which creates a session.
Is there any other way to redirect the user to an intercept page
without using HttpSession at all? Would it be possible to redirect the
user without using the page Map? And maybe save the original URL,
client side, to use it after log in.
Thanks so much
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
