HttpServletRequest.changeSessionId leads to 404 on lift/page/xxx.js
Open
@Shadowfiend is already working on this.
Since Mar 28, 2018.
- Dominant language
- Scala
- Stars
- 1.3k
- Forks
- 275
- PR merge metrics
- No merged PRs in 30d
Description
Mailing List thread: https://groups.google.com/forum/#!topic/liftweb/lcn6U6_Igxk
[Example project] https://github.com/fanf/demo-bug-lift-session
When the underlying session ID change without a clean invalidate/create cycle, for example with the HttpServletRequest.changeSessionId which seems to be the recommanded session fixation prevention method for servlet 3.1 (and so is used in authentication frameword like spring security), Lift session are destroyed after the data-lift-gc attribute is generated, and so lift page javascript at then end of the page fails because of 404 error.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.