Bug 430285

Comment 1 Ralf Sternberg 2014-03-13 10:04:47 EDT

This issue is caused by the use of HttpServletResponse.encodeURL() in StartupJson.getUrl().

At least in tomcat, this method returns an absolute URL when called with "".

Regardless of this issue, I wonder if it's correct to use this encodeURL() in StartupJson.getUrl() at all. This method is used to append the session id (URL rewriting) in case the client does not appear to support cookies. Since the initial request runs in it's own temporary UISession, there is no reason to enforce the UI requests to use the same HTTPSession.

Comment 2 Ralf Sternberg 2014-03-18 05:36:37 EDT

> At least in tomcat, this method returns an absolute URL when called with "".

From org.apache.catalina.connector.Response, encodeURL:

    // W3c spec clearly said 
    if (url.equalsIgnoreCase("")){
        url = absolute;
    }

I see two possible workarounds:

a) replace the empty string with "./" before passing it to encodeUrl()

- When the servlet path is "" we know that it's the root path, so "./" should should be correct. Looks like a clean and safe solution to me.

b) remove everything up to the last slash from the URL returned by encodeUrl()

- This would fail if the session id contains a slash.

> Regardless of this issue, I wonder if it's correct to use this encodeURL() in
> StartupJson.getUrl() at all...

On a closer look, encodeUrl() is still required for URL rewriting support, i.e. cases where either client or server has cookies turned off.
Since every POST request is made to the URL that is included in the startup JSON, the jsessionid must be included in this URL.

Comment 3 Ivan Furnadjiev 2014-03-24 06:12:57 EDT

(In reply to comment #2)
> I see two possible workarounds:
> 
> a) replace the empty string with "./" before passing it to encodeUrl()
> 
> - When the servlet path is "" we know that it's the root path, so "./" should
> should be correct. Looks like a clean and safe solution to me.
> 
> b) remove everything up to the last slash from the URL returned by encodeUrl()
> 
> - This would fail if the session id contains a slash.

I think that the first suggestion is safer. I'm voting for it.

Comment 4 Ralf Sternberg 2014-03-26 17:13:58 EDT

Implemented the change in https://git.eclipse.org/r/#/c/23938/. Tested with tomcat 7.0, when there is a jsessionid cookie, the message head is {"url":"./"}, when the cookie is not present, its {"url":"./;jsessionid=AFE65FE7A8944E0272CE9AE9D4464DAE"}.