[SHIRO-351] Shiro Native Session implementation cannot extract JSESSIONID From URL if JSESSIONID is URL parameter (not HTTP parameter)

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.2.0
• Fix Version/s: 1.2.2
• Component/s: Web
• Environment: N/A
• Assignee: Unassigned
• Reporter: Gareth Collins
• Created: 26/Mar/12 18:04
• Updated: 15/Jul/16 14:42
• Resolved: 15/Jul/16 14:42

Description

The background for this issue is here:

http://shiro-user.582556.n2.nabble.com/Shiro-Native-Sessions-quot-JSESSIONID-quot-or-quot-JSESSIONID-quot-td7367217.html

In summary the issue is that Shiro supports extracting JSESSIONID from urls of this format:

http://www.mycompany.com/myResource?JSESSIONID=ABCDEF

but not of this format (this URL format is generated by HTTPServletResponse encodeURL method and is Servlet specification 2.5 compliant):

http://www.mycompany.com/myResource;JSESSIONID=ABCDEF

Shiro should be able to support both URL formats.