[Tomcat-users] Unable to store a session with Tomcat 7 linux and Internet Explorer

Brian,
Simple initial observations show that the cookie returned by Tomcat 7
has the "Version:1" and "HttpOnly" options set.
Looks related -- at least the original post.

I wonder which options trips-up MSIE. Can you do some tests with cookies
explicitly setting the version and httponly options and see which ones
make MSIE choke?

- -chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

So a few quick things to try:

1) Set the useHttpOnly attribute to false in the <Context> of interest.

2) Set the system property org.apache.tomcat.util.http.ServerCookie.ALLOW_HTTP_SEPARATORS_IN_V0 to false.

3) Set the system property org.apache.tomcat.util.http.ServerCookie.ALLOW_NAME_ONLY to false (which is actually the default).

Also, if org.apache.catalina.STRICT_SERVLET_COMPLIANCE is set to true, try turning it off.

- Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.

Sort of.

Tomcat 7 is stricter in enforcing various specifications including the
cookie specification which states that / is not allowed in a cookie
value unquoted. Unfortunately / gets used a lot in cookies in the path
and if correctly quoted - i.e. path="/..." - IE chokes. Not exactly a
surprise considering just how badly IE adheres to the cookie specs. To
avoid exactly the issue you are seeing, Tomcat 7 does not enforce this
part of the specification by default.

I suggest a careful read of the following Tomcat 7 docs
http://tomcat.apache.org/tomcat-7.0-doc/config/systemprops.html with
particular reference to
org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR and
org.apache.catalina. STRICT_SERVLET_COMPLIANCE. My guess is that you
have set one or other of these to true.

I usually run Tomcat with the following:
org.apache.catalina. STRICT_SERVLET_COMPLIANCE=true
org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR=false

Mark

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Thanks very much Chris, Chuck, and Mark. I did indeed have

org.apache.catalina.STRICT_SERVLET_COMPLIANCE=true in my CATALINA_OPTS.

I remember setting that a long time ago to fix a problem, but I can't remember what it was.

I added org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR=false

as Mark suggested, and that fixed it right up. Thanks again.

--Brian.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Brian,
So, correct me if I'm wrong, but setting STRICT_SERVLET_COMPLIANCE=true
makes sessions break in all versions of MSIE. Do I have that right?

If that's the case, we might want to have a warning about it near the
explanation of what that flag does. The docs for FWD_SLASH_IS_SEPARATOR
*do* say something, but I think it's worth adding to the docs for
STRICT_SERVLET_COMPLIANCE.

Thanks,
- -chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Did you read the docs? It already does say that.

And before you say you were looking at the Tomcat 6 docs, the above
discussion only applies to Tomcat 7.

Finally, you are committer and all the docs are commit-then-review. If
you have improvements just commit them.

Mark



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Mark,
Yes, but I find it makes sense to discuss these things before just doing
them. CTR is only so useful :)

- -chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org