jsr340-experts@servlet-spec.java.net

[jsr340-experts] Re: SERVLET_SPEC-13: Make session fixation protection part of the spec

From: Remy Maucherat <rmaucher_at_redhat.com>
Date: Tue, 31 Jan 2012 09:49:47 +0100

On Tue, 2012-01-31 at 12:44 +1100, Greg Wilkins wrote:

> Unless you are not using cookies, in which case it is the response
> that has to encode URIs with the new session ID.
> Also,changing session cookies is done by adding a setCookie to the
> response, so that is also not a request method.
>
> Also as there are a lot more request wrappers than session wrappers,
> adding methods to session should be less disruptive than adding them
> to request.

And it is on the request object rather than the response object because
the session access is there. It may indeed need to access the response,
just like the original "getSession" does, which can set the session
cookie and encode the url as side effects. So it is very consistent.

-- 
Remy Maucherat <rmaucher_at_redhat.com>
Red Hat Inc