[DEFECT] /api/content should not return JSESSIONID cookie
Open
A pull request for this has already been merged.
- #34066 by @wezell — merged
- Dominant language
- Java
- Stars
- 970
- Forks
- 486
- Avg merge
- 3d 33m
- Merged PRs (30d)
- 170
Description
Problem Statement
/api/content/ requests should not return JSESSIONID session cookies
It is possible this impacts other APIs.
Steps to Reproduce
curl -s --head 'https://demo.dotcms.com/api/content/render/false/query/+contentType:Languagevariable%20+working:true/orderby/modDate%20desc'
HTTP/2 200
...
set-cookie: JSESSIONID=C0EFF3DA3BF6AD4A14CABB6861EA4E78; Path=/; Secure; HttpOnly; SameSite=Lax
Acceptance Criteria
Not sure
dotCMS Version
latest
Severity
Medium - Some functionality impacted
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the curl request against /api/content/render/false/query and inspect the response headers for JSESSIONID. Trace the API's session and cookie handling, including whether other APIs are affected. Done means the affected API responses no longer return a JSESSIONID cookie; a linked pull request is already merged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100