users@glassfish.java.net

Re: Session fixation countermeasures

From: <glassfish_at_javadesktop.org>
Date: Mon, 07 Jun 2010 09:10:48 PDT

Hi , I had found the old post and think maybe you can help me.
We are migrating the app from weblogic to glassfish v2. and one of the program fail. After debug, we find that the sessionid which initiated from one jsp, then the same sessionid pass to a function in ejb. In this function, it generate the URL based on the sessionid, but when this URL run, the sessionid change, it create a new sessionid. Please see the code of the function below. Do you have any idea why glassfish did not maintain the sessionid? Thanks.

public boolean sendURLOutStreamByEmail(String[] pageName, String[] fileName, String toEmail, String emailSubject, String sessionId, String baseURL) {
File[] files = new File[fileName.length];
String[] fullName = new String[fileName.length];
String filePrefix = null;

try{
String parentDir = getTmpDir();
for (int i = 0; i < pageName.length; i++) {
String url = baseURL + pageName +"&JSESSIONID="+sessionId;


filePrefix = parentDir;//fundIds ;
System.out.println("URL is" + url);
System.out.println("Generating xls...................filePrefix is" + filePrefix);
fileName =]]]]]]]"]]
[Message sent by forum member 'huancon']

http://forums.java.net/jive/thread.jspa?messageID=473174