[EXTCDI-299] Session Cookie Configuration with Secure on non secure URL results in forever redirect loop

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 1.0.5
• Component/s: JEE-JSF20-Module
• Environment: Windows 7, JBoss AS 7.1.0.Final
• Assignee: Unassigned
• Reporter: Christian Beikov
• Created: 28/Aug/12 20:26
• Updated: 28/Feb/14 09:06

Description

This occurs, because the session cookie of the webapp is configured to be secure, but if you don't access the application via https you get redirected forever.
The reason for that is of course, that no session is available at the server side when the redirected request arrives at the server side.
The only solution to that is, to supply a specialized WindowContextConfig#isUrlParameterSupported that returns false, but that results in ViewExpiredException on Postback.

In my opinion CODI should somehow forward to an error page or so when this kind of configuration happens or don't redirect to use window ids at all.