https://issues.apache.org/bugzilla/show_bug.cgi?id=49598
Summary: Session update fails and adds second cookie header
without header name
Product: Tomcat 7
Version: trunk
Platform: All
OS/Version: All
Status: NEW
Severity: regression
Priority: P2
Component: Catalina
AssignedTo: [email protected]
ReportedBy: [email protected]
The following code in a Servlet or JSP will cause invalid session cookies to be
sent to the client:
HttpSession session = req.getSession(true);
session.invalidate();
req.getSession(true);
Essentially the client will still see the old session cookie and then try and
use the now invalidated session, breaking most applications that do this.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
