Tracking of web login state in JBoss AS 7.1.1

[sfcoy]

Hi there,

We are using javax.servlet.http.HttpServletRequest#login(java.lang.String, java.lang.String) to authenticate users in JBoss AS 7.1.1, and found that unless we prefix the login call with

{code:java}request.getSession(true);{code}

the container forgets that we have authenticated for subsequent requests.

This seems like a bug to me.

[jfclere]

well request.getSession(true); creates session and login() authenticate user that are 2 different things.

[sfcoy]

If I leave out the request.getSession(true);, subsequent requests to protected resources fail with a 403.

[jfclere]

Because you need to create a session.

[sfcoy]

I don't need to explicitly create a session for form based or BASIC authentication.

The spec (13.3) says:

The login method allows an application to perform username and password collection (as an alternative to Form-Based Login).

and (13.10)

Containers may create HTTP Session objects to track login state.

This led me to believe that login state will be tracked between requests.

I know that WebSphere, for example, does not use the HttpSession for tracking login state. It uses a separate cookie instead.