Re: Apache::ASP, Sessions and SSL ...

2001-02-16 Thread Joshua Chamas

"Demetrios C. Christopher" wrote:
 
 Having been trained in the Microsoft Arts, I decided
 upgrading instead of troubleshooting the problem might
 be well worth it ... I upgraded to 2.09 and things are
 working fine now ... if things stop working again I'll
 be paying Joshua a visit! (just kidding, we love you JC).
 
 Still, if anyone can think of why all of the sudden
 adding SSL to the ASP/Sessions equation would make
 things get all screwed up I'd like to hear it.
 

This problem doesn't really make much sense to me.  The
SSL transport layer SHOULD be independent of the mod_perl
layer that Apache::ASP resides in.  I imagine that there
could have been something funny with the browser behavior,
but not to share sessions' data.

Also, I looked at the change log between 2.03  2.09,  didn't
see anything that would indicate a fix to this problem.  I know
there was a lot of work done on the Sessions implementation,
as well as random session-id generation, but I didn't know of
any bugs with what was there before in this regards.

-- Josh

_
Joshua Chamas   Chamas Enterprises Inc.
NodeWorks  free web link monitoring   Huntington Beach, CA  USA 
http://www.nodeworks.com1-714-625-4051



Apache::ASP, Sessions and SSL ...

2001-02-15 Thread Demetrios C. Christopher

Hello all,
I am running A::A 2.03 on a Solaris 2.6 box with Stronghold 2.4.2, whatever.
The truth is I doubt the rest matters ... I am running a pretty cool web app
where fields are collected, validated and then appropriate action is taken,
one of which is to make an HTTP call (LWP) to a third-party site and
exchange
some info, register, blah-blah-blah.

To the point: when I use http for everything, the session variables work
fine
and everything works perfectly, as it's coded to do.  The moment I try to
take everything under https (since some of the information is personal and
of
financial nature) things work intermittently.  I have it down to a script of
what things you can do and what you cannot.  There is no logic behind having
to enter everything the first time around (the script is self-posting,
self-validating) in order to get the proper outcome.  At some point I
started
to dump the Session variables to see what's in them and found data from
_OTHER_ sessions!  Argh!  No, this has nothing to do with perl's closure
issue ... all functions come from .pm's and there is no problem with
function
calls.

I am at wits end ... I just went through all this in the last couple of days
and just bothered to check for a newer version of Apache::ASP.  I will try
to
upgrade soon to see if that does anything but I was hoping someone might
have seen this problem before where SSL session information did not work
as well as it should.

Did I mention this?: under https, calls to some remote server would
intermit.
fail and give back a 403 - Access Forbidden ... what the heck?  This
function
merely took data from the session and passed it as parameters ... what sort
of influence would which port the server was running on have on the HTTP
req.
being made and/or on the remote server's ability to process the
request?!?!?!

Oh well, hope someone out there can help out.  Thanks in advance.

Demetrios




Re: Apache::ASP, Sessions and SSL ...

2001-02-15 Thread Demetrios C. Christopher

Having been trained in the Microsoft Arts, I decided 
upgrading instead of troubleshooting the problem might
be well worth it ... I upgraded to 2.09 and things are
working fine now ... if things stop working again I'll
be paying Joshua a visit! (just kidding, we love you JC).

Still, if anyone can think of why all of the sudden
adding SSL to the ASP/Sessions equation would make
things get all screwed up I'd like to hear it.

Take care,
Demetrios