2

In my application I have an embedded jetty server (version 8.1.2) running a web application that uses spring web security. The jetty server is configured to use the JDBCSessionManager

One of the security filters that spring employs is a subclass of AbstractAuthenticationProcessingFilter, in it, it has a SessionAuthenticationStrategy which by default is a SessionFixationProtectionStrategy. This protection strategy creates a new session, as a copy of the original session and invalidates the old one.

Now when I try to login to the web application, I see that a new session is created, but the authentication attributes that are added to the new session are not written back to the database. Moreover, I see that the old session is written to the database with new attributes even though it was invalidated.

Finally, when a new http request arrives as part of the new session, it does not pass authentication because of the above.

After some investigation, I found that this behavior does not happen in older versions of jetty (I tried 7.1.4), and I see that the new session data is written to the database.

I could of course solve this issue by any of the following:

  • Use an older version of jetty
  • Disable the session fixation protection strategy
  • Use the default session manager instead of the JDBCSessionManager

But assuming non of the above options are valid for me, I was wondering if there is any solution to this problem.

Thanks!

dankilman
  • 886
  • 2
  • 9
  • 18
  • 1
    write up a clear description of the problem into bugs.eclipse.org under RT/Jetty and we'll fix it, its not immediately clear what the issue is though...also you could try 8.1.6 (or 8.1.7 which will be in central shortly) and see if it is still an issue, we have fixed a handful of session bugs recently – jesse mcconnell Sep 11 '12 at 12:57
  • Thanks... it turned out that this behavior was part of the `finally` clause of `SessionHandler#doScope` and as you suggested, this behavior was indeed fixed in 8.1.6 (maybe earlier, this is what i checked) – dankilman Sep 11 '12 at 19:49

1 Answers1

1

Resolved in newer releases of jetty 8, at least 8.1.6 :)

jesse mcconnell
  • 7,102
  • 1
  • 22
  • 33