java ee - Mysterious HttpSession and session-config dependency -


good day. i'm developing java web app servlets\jsp using tomcat 7.0. during request client put , object session , use forward. after forward processing same request object can retreived if secure parameter false otherwise not stored in session.

    <session-config>         <session-timeout>15</session-timeout>         <cookie-config>             <http-only>true</http-only>             <secure>true</secure>         </cookie-config>         <tracking-mode>cookie</tracking-mode>     </session-config>

i've figured out "...cookies can created 'secure' flag, ensures browser never transmit specified cookie on non-ssl...". i've configured tomcat use ssl, haven't helped. changing tracking mode ssl haven't helped well. how session-config , httpsession object correlate in case? problem?


Comments

Post a Comment

Popular posts from this blog

jquery - Invalid Assignment Left-Hand Side -

i trying assign class tag via jquery, resulting in error through firebug says "invalid assignment left-hand side" on fourth line below. <cfoutput> $('.pngfix a').each(function(index) { var hreflink = $(this).attr("href"); if (hreflink.tolowercase() = '../audio.cfm') { $(this).addclass('audioimg'); } }); </cfoutput> looking around online, looks syntax problem, don't seem see it... any tips? thanks if (hreflink.tolowercase() = '../audio.cfm') that attempts assign value, rather check equality. change = operator == .
Read more

javascript - Preserving URL fragment through CAS sign-on -

i maintain single-page application uses yui 2.8 history module retain local options in url fragment. i've put behind cas authentication, , i'm finding fragment gets lost during cas authentication. retained in signon url, not when redirected application page. true after session timeouts, users bumped default options after re-authentication. any suggested strategies hanging on fragment (or underlying javascript state) though cas roundtrip? you can store in cookie, sessionstorage , or value of window.name if there no security implications: //cookie document.cookie = "fragid=" + window.location.hash + ";path=/"; //session storage window.sessionstorage.setitem("fragid",window.location.hash); //window window.name = window.location.hash references url fragments , redirects – ieinternals
Read more

asp.net mvc - Implementing normal user/pass, Twitter & Facebook auth -

i have created public facing website allows login using username/password, or twitter, or facebook. when logging in twitter first time (for example), user created in database nickname matching twitter screen name. want nickname always unique. the problem in cases user nickname exists, user can't added. unsure accepted approach problem, solution can see far ask user override nickname, doesn't seem elegant. the reason nickname needs unique not code issue, interface issue, example there forums , want each user uniquely identified nickname. are there other methods can suggest dealing problem? edit: @ request of of replies clarify example: lets have user named joe bloggs member on website. not member of twitter or facebook. nickname on site joebloggs. then, joe bloggs comes along, , wants sign in twitter account. twitter name joebloggs, when signs in twitter, system attempts automatically set nickname joebloggs. however, nickname exists. normal or best practice ...
Read more