[WICKET-5129] HttpsMapper Does Not Switch to SSL when there is no JSESSIONID Cookie

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 6.6.0
• Component/s: wicket, wicket-auth-roles
• Labels: HttpsMapper
• Assignee: Unassigned
• Reporter: Tim Urberg
• Created: 03/Apr/13 19:05
• Updated: 17/Jun/14 07:37

Description

I'm having an issue with HttpsMapper not switching to SSL when there is no JSESSIONID cookie. It's happening with wicket-auth-roles when the user goes to the home page, which need authentication. I have this code in my init method in my WebApplication class.

getSecuritySettings().setAuthorizationStrategy(new IAuthorizationStrategy()
{
@Override
public <T extends IRequestableComponent> boolean isInstantiationAuthorized(Class<T> componentClass)
{
if (AuthenticatedWebPage.class.isAssignableFrom(componentClass))

{ if (MyAuthenticatedWebSession.get().isSignedIn()) return true; throw new RestartResponseAtInterceptPageException(new LoginPage()); }

return true;
}

@Override
public boolean isActionAuthorized(Component component, Action action)

{ return true; }

});

HomePage implements AuthenticatedWebPage and LoginPage has the @RequireHttps annotation. This only seems to happen when there is no JSESSIONID cookie. The URL looks like this:

http://localhost:8080/login;jsessionid=1c9nRTpWGWynRXdX1WKC5ZnSfTNKCydGTdHH83mvfXQZQcQ8fLpx!-1875818450?0

when it should be https://localhost:8443/login. If I try it a second time after the cookie has been created it works fine. This is not a problem when I go straight to http://localhost:8080/login (works fine then).

Issue Links

• is blocked by: WICKET-5621 Store more information to/with BufferedWebResponse that survives multi-RequestCycle redirect
• links to: Discussion at users@ about adding more meta data to the stored buffered response