0

I'm trying to use sitemesh to pull content together on a screen. You have to be "logged" into the site to view the page that site mesh is displaying and you must be logged in to view the components sitemesh is trying to pull in and decorate.

I'm using spring security and PersistentTokenBasedRememberMeServices to do this. What happens is, when site mesh calls out to get it's components to decorate it gets the login screen provided by spring security instead of the content even though the user is logged in and has access to the page.

Digging through the sitemesh code, site mesh is making a URL and a URLconnection to make it's calls to decorate. 

URL url = new URL(this.page);

URLConnection urlConn = url.openConnection();

urlConn.setUseCaches(true);

BufferedReader in = new BufferedReader(new InputStreamReader(urlConn.getInputStream()));

So I guess my question is... can I just attach the spring security token to the urlConnection like this? 

URL url = new URL(page);
URLConnection urlConn = url.openConnection();
urlConn.setRequestProperty("Cookie", myCookie);
urlConn.setUseCaches(true);
urlConn.connect();

If so, what does the format of the cookie need to be? I've tried what is below (the gibberish is the value of the security cookie generated by spring security)

securityCookie=Y2E0cFR1WWp6RTRjTzRBSFhYaG50dz09OjR mNzlON2syVXh3M01BSXRONGV2QXc9PQ

It doesn't work as I get a cookie theft exception from Spring Security. Any ideas? Do I need to add the path or domain? If so what is the format?

Does the cookie value need to be encoded in some way?

Tomasz Nurkiewicz
  • 334,321
  • 69
  • 703
  • 674
E Paiz
  • 661
  • 4
  • 9
  • 19
  • Are you using `` tag with `page` attribute pointing to another server (with `http://` prefix?) – Tomasz Nurkiewicz Oct 06 '12 at 16:27
  • I'm using the following: The app is on the same server. – E Paiz Oct 07 '12 at 15:20
  • So why not just use "`solo/2609999`" URI? It should work as well. Also by hardcoding `localhost:8080` it won't work once you deploy it to some server. – Tomasz Nurkiewicz Oct 07 '12 at 15:22
  • "remember-me" is to remember the authentication-data across different sessions. if i understand u, even when you are in the same session it is not working ... am i right ? in your case, the user logs in, and then the sitemesh still get login screen... the sitemesh runs on the same session where the user has logged in? – OhadR Oct 15 '12 at 15:25
  • OhadR -- You are correct. I'm using the same session for the app with sitemesh that the user has logged in with. When user is logged in sitemesh still gets the login screen – E Paiz Nov 04 '12 at 23:27

0 Answers0