CODEWITHSUNDEEP
url-rewritingjettyembedded-jettyhttp-redirectjsessionid
Laurent Grégoire
Laurent Grégoire

Reputation: 4146

Embedded Jetty - Disable URL rewriting for external URLs

I'm using Jetty, in an embedded server configuration. When the client is not accepting cookies, Jetty uses URL rewriting to encode the session ID in the URL itself (adding something like ;jsessionid=xxx to the URL).

My problem is that when I redirect the client (using a HTTP 302, moved temporarily) to an external URL, this URL rewriting breaks the external URL I redirect to (ie, ;jsessionid=xxx is also present in the URL).

How can I selectively disable URL rewriting on embedded Jetty for external URL? Is this a bug of Jetty? I'm using Jetty 9.4.7. I also tried to set the option org.eclipse.jetty.servlet.SessionDomain, but with no avail.

Upvotes: 0

Views: 789

Answers (1)

Laurent Grégoire
Laurent Grégoire

Reputation: 4146

I finally found the answer by digging into the Jetty code path. You just need to enable the following init option: 

org.eclipse.jetty.servlet.CheckingRemoteSessionIdEncoding=true

For example for embedded Jetty:

ServletContextHandler context = ...
context.setInitParameter(
    "org.eclipse.jetty.servlet.CheckingRemoteSessionIdEncoding",
    "true");

Note for the interested reader: The code related to this is in org.eclipse.jetty.server.Response::encodeURL() (line 477 for v9.4.7).

Upvotes: 2

Related Questions