How can I prevent spring-security from appending ;jsessionid=XXX to login redirects?

user_11809 0
Viewed 39080

When an unauthenticated client requests a URL that requires a non-anonymous access level as defined in security-config.xml, spring security sends an HTTP redirect to our login page (e.g. /login). That's fine.

The issue is that absent an existing session (identified by a cookie provided in the client's request), spring-security issues a redirect that also specifies the client's new session in the URL, e.g. /login;jsessionid=8o7pglapojus.

Many containers support this (apparently it works fine in tomcat?), but it appears that Jetty (which is what we're using right now) does not -- the redirected URL comes through to our URL router completely intact (including the jsessionid "parameter"), and the named session is not associated with the /login request by jetty/spring-security (i.e. a totally new session ID is provided in the Set-Cookie header of the response to the /login request).

We can work around this by matching /login.* in our routes, but I'm curious if there's any way to prevent the emission of the session id in the authentication redirect to begin with.

spring-security jetty servlets tomcat
7 Answers

In Spring Security 3.0.0 M1 or newer you could set disable-url-rewriting="true" in the <http> namespace. See if that helps. Also see this feature request.

user_1578820

Here is how I solved this issue...

the scenario was I had a few session less and security="none" pages and upon re-direct post submission - redirect url used to get appended with ;Jsessionid= in url - ofcourse leading to errors...

Also, i couldn't add disable-url-rewriting="true" also didn't work.

What worked for me if below code in submission on form-submission

HttpSession session = request.getSession();
if (session != null) session.invalidate();

this made sure there is no active session - which ensures spring on redirect post submission doesn't need to carry session information, hence no need to add JSESSION to the url.

This was of course needed my specific case.. and cannot be used as generic solution for the whole application. Let me know if this helps you.

user_91562650

I already added an answer to this for specific use cases - here are multiple ways you can tackle it (summarizing my discovery journey and experiments)

  1. @ overall level - ensures no url rewriting level

<sec:http pattern="/<your url pattern>/**" disable-url-rewriting="true"

  1. ensures no session information is not needed, hence no need to append JSESSSIONID

<%@ page session="false" %>

  1. @ Controller level - before directing to page/url invalidate the session. No Session > No Session Information TO Carry > No appending JSESSIONID

HttpSession session = request.getSession(); if (session != null) session.invalidate();

These solutions are specific to spring security. There are other solutions which can be done @ Tomcat level

  1. changing session tracking to COOKIE, session information already with browser cookie > No need to pass information in url > No appending JSESSIONID [doesn't work where cookies are not allowed, I faced the issue with Safari/Opera Browsers + Chrome with strict third party cookie settings]

<session-config> <tracking-mode>COOKIE</tracking-mode> </session-config>

  1. disableURLRewriting at the web server level

In WEB-INF/web.xml disableURLRewriting = "true"

Hope this helps you.

user_91562650
Related