apche http lost session

------_=_NextPart_001_01CA557B.7105D061
Content-Type: multipart/alternative;
boundary="----_=_NextPart_002_01CA557B.7105D061"


------_=_NextPart_002_01CA557B.7105D061
Content-Type: text/plain;
charset="windows-1255"
Content-Transfer-Encoding: quoted-printable

Hi

=20

I have apache http 2.2 server that forward request to jboss web server =
(version 4.2)

I configure my http server to forward request to my login page to secure =
https

When the user login I save the user information in my session

After the user login I forward the request to non-secure page (http)

But when I try to get the user information from the session I found =
that my session was lost

How can I solved this?

Thanks Yaniv

=20

=20

=20


------_=_NextPart_002_01CA557B.7105D061
Content-Type: text/html;
charset="windows-1255"
Content-Transfer-Encoding: quoted-printable

crosoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:wo=
rd" xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D=
"http://www.w3.org/TR/REC-html40">


255">






<=
!--START_FRAME-->

Re: apche http lost session

Are you sure that you're using the same domain for the http and https
requests?

Are you sure that you're not setting the "secure" flag on the session
cookie?

Issac

yanivo@harel-ins.co.il wrote:
>
> Hi
>
>
>
> I have apache http 2.2 server that forward request to jboss web server
> (version 4.2)
>
> I configure my http server to forward request to my login page to
> secure https
>
> When the user login I save the user information in my session
>
> After the user login I forward the request to non-secure page (http)
>
> But when I try to get the user information from the session I found
> that my session was lost
>
> How can I solved this?
>
> Thanks Yaniv
>
>
>
> *picture (2)*
>
>
>
> ------------------------------------------------------------ ------------
> This message was enriched by Impactia Technologies Ltd.
> www.impactia.com
> Please do not enrich
>
> emails sent to me.


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

RE: apche http lost session

--Boundary-00=_n4F5KxwEIuWYaK2
Content-Type: Multipart/alternative;
boundary="Boundary-00=_n4F5KAL8ZkH0IuX"

--Boundary-00=_n4F5KAL8ZkH0IuX
Content-Type: text/plain;
charset="windows-1255"
Content-Transfer-Encoding: 8bit

Yes I am using the same domain
I don’t know about the "secure" flag
Is this apache configuration or java configuration?
Can u tell me where do I set this flag?


___________________________
éðéá àåùøé
öååú îéúá – úåëðéúï JAVA
ùìåçä:7435 


-----Original Message-----
From: Issac Goldstand [mailto:margol@beamartyr.net]
Sent: Sunday, October 25, 2009 4:09 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] apche http lost session

Are you sure that you're using the same domain for the http and https
requests?

Are you sure that you're not setting the "secure" flag on the session
cookie?

Issac

yanivo@harel-ins.co.il wrote:
>
> Hi
>
>
>
> I have apache http 2.2 server that forward request to jboss web server
> (version 4.2)
>
> I configure my http server to forward request to my login page to
> secure https
>
> When the user login I save the user information in my session
>
> After the user login I forward the request to non-secure page (http)
>
> But when I try to get the user information from the session I found
> that my session was lost
>
> How can I solved this?
>
> Thanks Yaniv
>
>
>
> *picture (2)*
>
>
>
> ------------------------------------------------------------ ------------
> This message was enriched by Impactia Technologies Ltd.
> www.impactia.com
> Please do not enrich
>
> emails sent to me.


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org



--Boundary-00=_n4F5KAL8ZkH0IuX
Content-Type: Text/HTML;
charset="windows-1255"
Content-Transfer-Encoding: quoted-printable

//www.w3.org/TR/REC-html40/loose.dtd">=0A=0A=0A =0A content=3D"text/html; charset=3Diso-8859-8">=0A MER_MAIN_TABLE" BGCOLOR=3D"white">

=0AFrom: Issac Goldstand mailto:[
l@beamartyr.net">margol@beamartyr.net]=0ASent: Sunday, October 25, 20=

09 4:09 PM=0ATo: users@httpd.ap=

ache.org=0ASubject: Re: [users@httpd] apche http lost session=0A
>=0A=0A


Are =

you sure that you're using the same domain for the http and https
=0Ar=

equests?

Are you sure that you're not setting the "secure" fl=

ag on the session
=0Acookie?

Issac


mailto:yanivo@harel-ins.co.il">yanivo@harel-ins.co.il wrote:
=0A
M> >
=0A> Hi
=0A>
=0A>
=0A>
=0A> I have apache http 2.2 se=

rver that forward request to jboss web server
=0A> (version 4.2)
=0A=

>
=0A> I configure my http server to forward request to my login page =

to
=0A> secure https
=0A>
=0A> When the user login I save the us=

er information in my session
=0A>
=0A> After the user login I forwa=

rd the request to non-secure page (http)
=0A>
=0A> But when I try t=

o get the user information from the session  I found
=0A> that my sess=

ion was lost
=0A>
=0A> How can I solved this?
=0A>
=0A> Thank=

s Yaniv
=0A>
=0A>
=0A>
=0A> *picture (2)*
=0A>
=0A>
=

=0A>
=0A>  ------------------------------------------------------------ =

------------
=0A> This message was enriched by Impactia Technologies L=

td.
=0A>  <
 HREF=3D"http://www.impactia.com">http://www.impactia.com>
=0A> Pl=

ease do not enrich
=0A>=0A
tpd.apache.org&domain=3Dharel-ins.co.il&id=3D777>
=0A> emails sen=

t to me.
 


=0A


The official User=

-To-User support forum of the Apache HTTP Server Project.
=0ASee 
http://httpd.apache.org/userslist.html> for more info.
=0ATo unsubscri=

be, e-mail: users-u=

nsubscribe@httpd.apache.org
=0A"   from the digest: 
 lto:users-digest-unsubscribe@httpd.apache.org">users-digest- unsubscribe@h=

ttpd.apache.org
=0AFor additional commands, e-mail: 
 lto:users-help@httpd.apache.org">users-help@httpd.apache.org

=


=0A

RE: apche http lost session

------_=_NextPart_001_01CA5615.824F21F0
Content-Type: multipart/alternative;
boundary="----_=_NextPart_002_01CA5615.824F21F0"


------_=_NextPart_002_01CA5615.824F21F0
Content-Type: text/plain;
charset="windows-1255"
Content-Transfer-Encoding: quoted-printable

=20

Hi again I need help=20

=20

I have apache http 2.2 server that forward request to jboss web server =
(version 4.2)

I configure my http server to forward request when user login to secure =
page (https)

When the user login I save the user information in my session (not in a =
cookie!!!)

After the user success login I forward the request to non-secure page =
(http)

But when I try to get the user information from the session I found =
that my session was lost between the pages=20

(https to http)

How can I solved this ?

I can't save any information about the client in the browser because =
secure issue

My web site base on java=20

Thanks Yaniv

=20

=20

=20


------_=_NextPart_002_01CA5615.824F21F0
Content-Type: text/html;
charset="windows-1255"
Content-Transfer-Encoding: quoted-printable

crosoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:wo=
rd" xmlns:x=3D"urn:schemas-microsoft-com:office:excel" xmlns:p=3D"urn:sch=
emas-microsoft-com:office:powerpoint" xmlns:a=3D"urn:schemas-microsoft-co=
m:office:access" xmlns:dt=3D"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" x=
mlns:s=3D"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs=3D"urn:sche=
mas-microsoft-com:rowset" xmlns:z=3D"#RowsetSchema" xmlns:b=3D"urn:schema=
s-microsoft-com:office:publisher" xmlns:ss=3D"urn:schemas-microsoft-com:o=
ffice:spreadsheet" xmlns:c=3D"urn:schemas-microsoft-com:office:component:=
spreadsheet" xmlns:odc=3D"urn:schemas-microsoft-com:office:odc" xmlns:oa=3D=
"urn:schemas-microsoft-com:office:activation" xmlns:html=3D"http://www.w3=
org/TR/REC-html40" xmlns:q=3D"http://schemas.xmlsoap.org/soap/envelope=
/" xmlns:rtc=3D"http://microsoft.com/officenet/conferencing" xmlns:D=3D"D=
AV:" xmlns:Repl=3D"http://schemas.microsoft.com/repl/" xmlns:mt=3D"http:/=
/schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2=3D"http://sche=
mas.microsoft.com/office/excel/2003/xml" xmlns:ppda=3D"http://www.passpor=
t.com/NameSpace.xsd" xmlns:ois=3D"http://schemas.microsoft.com/sharepoint=
/soap/ois/" xmlns:dir=3D"http://schemas.microsoft.com/sharepoint/soap/di r=
ectory/" xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" xmlns:dsp=3D"htt=
p://schemas.microsoft.com/sharepoint/dsp" xmlns:udc=3D"http://schemas.mic=
rosoft.com/data/udc" xmlns:xsd=3D"http://www.w3.org/2001/XMLSchema" xmlns=
:sub=3D"http://schemas.microsoft.com/sharepoint/soap/2002/1/ alerts/" xmln=
s:ec=3D"http://www.w3.org/2001/04/xmlenc#" xmlns:sp=3D"http://schemas.mic=
rosoft.com/sharepoint/" xmlns:sps=3D"http://schemas.microsoft.com/sharepo=
int/soap/" xmlns:xsi=3D"http://www.w3.org/2001/XMLSchema-instance" xmlns:=
udcs=3D"http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf=3D"http:/=
/schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p=3D"http://schemas.m=
icrosoft.com/data/udc/parttopart" xmlns:wf=3D"http://schemas.microsoft.co=
m/sharepoint/soap/workflow/" xmlns:dsss=3D"http://schemas.microsoft.com/o=
ffice/2006/digsig-setup" xmlns:dssi=3D"http://schemas.microsoft.com/offic=
e/2006/digsig" xmlns:mdssi=3D"http://schemas.openxmlformats.org/package/2=
006/digital-signature" xmlns:mver=3D"http://schemas.openxmlformats.org/ma=
rkup-compatibility/2006" xmlns:m=3D"http://schemas.microsoft.com/office/2=
004/12/omml" xmlns:mrels=3D"http://schemas.openxmlformats.org/package/200 =
6/relationships" xmlns:spwp=3D"http://microsoft.com/sharepoint/webpartpag=
es" xmlns:ex12t=3D"http://schemas.microsoft.com/exchange/service s/2006/ty=
pes" xmlns:ex12m=3D"http://schemas.microsoft.com/exchange/service s/2006/m=
essages" xmlns:pptsl=3D"http://schemas.microsoft.com/sharepoint/soap/ Slid=
eLibrary/" xmlns:spsl=3D"http://microsoft.com/webservices/SharePointPor ta=
lServer/PublishedLinksService" xmlns:Z=3D"urn:schemas-microsoft-com:" xml=
ns:st=3D"
" xmlns=3D"http://www.w3.org/TR/REC-html40">


255">






<=
!--START_FRAME-->

Re: RE: apche http lost session

yanivo@harel-ins.co.il wrote:
>
....
> I have apache http 2.2 server that forward request to jboss web server (version 4.2)
> I configure my http server to forward request when user login to secure page (https)
> When the user login I save the user information in my session (not in a cookie!!!)
> After the user success login I forward the request to non-secure page (http)
> But when I try to get the user information from the session I found that my session was lost between the pages
> (https to http)
> How can I solved this ?
>
Someone else here already gave you a good clue.
You should probably start by reading
http://en.wikipedia.org/wiki/HTTP_cookie
and see what they have to say about "secure" cookies.
Your session data is not saved in a cookie, but the "key" to the session
data is saved in a cookie. The server needs that key, in order to
retrieve the session data at the next request.
But, if that cookie is set up at a moment where the connection is HTTPS,
then the cookie is "marked" for (secure) HTTPS.
Your browser (probably) will not send that cookie to the server at the
next request, if that next request happens under (non-secure) HTTP.
And since then, the new request arrives to the server without the
session-id cookie, the server thinks this is a new session.
That is what makes you think that your session "is lost".

Another suggestion : get yourself a browser add-on like HttpFox for
Firefox, or Fiddler2 for IE. Then run your login sequence, and
carefully examine the HTTP headers of the requests and responses.
That will show you what is going on.
You will see "SetCookie" headers being sent by the server, and "Cookie"
headers being sent by the browser. Or not.
Look for cookies named "JSESSIONID".


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org