[
https://issues.apache.org/jira/browse/DELTASPIKE-1071?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15136541#comment-15136541
]
Sean Flanigan commented on DELTASPIKE-1071:
-------------------------------------------
I tried changing AmpersandFilter to throw away everything after "{{&}}", and
the cloning problem went away.
It turns out that the window cloning only happens if the filter somehow treats
everything after "{{&}}" as being parameters, instead of after "{{?}}" the way
it should be. The mismatch between client and server-side interpretations of
the URL (eg by a misconfigured UrlRewriteFilter) is what triggers the problem,
because the filter effectively causes the server to use a non-standard
interpretation, whereas the client uses the standard interpretation.
So, if you're using something like Tuckey UrlRewriteFilter with DeltaSpike, be
sure you don't accidentally interpret part of the URL *path* as *query*
parameters (perhaps by putting them after "{{?}}" in your "to" replacement), or
you could trigger window cloning.
(Personally, I'm hoping the OCPsoft URL-Rewriting Framework will be a safer
option for my URL rewriting needs.)
If I could think of a succinct warning for the above, I might suggest a pull
request for the documentation.
> URLs like ?&dswid=XYZ lead to window cloning
> --------------------------------------------
>
> Key: DELTASPIKE-1071
> URL: https://issues.apache.org/jira/browse/DELTASPIKE-1071
> Project: DeltaSpike
> Issue Type: Bug
> Components: JSF-Module
> Affects Versions: 1.5.1, 1.5.2
> Reporter: Sean Flanigan
> Assignee: Thomas Andraschko
> Fix For: 1.5.3
>
> Attachments: AmpersandFilter.java
>
>
> Using default window mode on Chrome (equates to LAZY?), if a clickable URL
> ends in {{?&dswid=XYZ}}, opening that link in a new tab clones the old tab's
> {{window.name}} and {{dswid}}, instead of generating a new id.
> I had this (very confusing) problem in my application when a urlrewrite
> outbound-rule accidentally used {{&dswid=XYZ}} instead of {{?dswid=XYZ}}, but
> for simple applications it is easiest to reproduce like this:
> 1. visit a page URL which ends with {{?dswid=XYZ}}
> 2. use the javascript console to check {{window.name}}
> 3. edit the URL so that it ends with {{?&dswid=XYZ}}
> 4. paste the edited URL into a fresh browser tab (where {{window.name}} is
> empty)
> 5. use the javascript console to check {{window.name}} for the new tab
> Both tabs have the same {{window.name}}, which leads to all window-based
> scopes in the session being shared for future requests in the affected tabs.
> I haven't dug into the code too closely, but I suspect {{windowhandler.js}}
> is setting {{window.name}} when it sees {{&dswid}} in the URL, instead of
> triggering a lazy redirect as I think it should.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
