Logging on does not create a new session in /jetspeed webapp

• Key: JS2-156
• Type: Bug
• Status: Closed
• Resolution: Invalid
• Priority: Major
• Assignee: Unassigned
• Reporter: David Sean Taylor
• Component/s: Container
• Affects Version/s: 2.0-dev/cvs
• Fix Version/s: 2.0-dev/cvs, 2.0-M2

Description

Logging on does not create a new session in /jetspeed webapp
It seems like it only creates a new session in the /security webapp
All portlet apps need to have their session reset

Comments

David, I checked this out, and you are right that the session(s) are not created anew after login: the current sessions are reused. But, logging out *does* invalidate all the sessions.

So, if I understand the problem correctly, this issue concerns anonymous session data which you want to be discarded after a user logs on, correct?

I think in certain situations (shoppingcard comes to my mind) this is exactly what you would want. I think portlets applications which allow anonymous access should take real care what they save in the session.
If it really needs its session to be cleared after login, maybe a session listener could detect login (I haven't tested that out yet though) and clear the attributes.

Anyways, my first impression is that (assuming my assumptions from above are correct) this isn't a fault of Tomcat nor the Jetspeed login functionality.

[Ate Douma]

Its not a bug, its a feature ;-)
Anyway, after logoff, all (sub)sessions are automatically logged out too.