-
Type:
Bug
-
Resolution: Won't Fix
-
Priority:
Medium
-
Component/s: None
-
None
I believe there is a problem with the scoping for the JSESSIONID cookie issued when visiting /wiki, please consult the http dump below
Request 1:
URL: https://studio.atlassian.com/wiki/dashboard.action Host: studio.atlassian.com IP: 207.223.243.40 Location: Saint Louis, MO* Error/Status Code: 200 Start Offset: 0.593 s DNS Lookup: 95 ms Initial Connection: 84 ms SSL Negotiation: 413 ms Time to First Byte: 445 ms Content Download: 416 ms Bytes In (downloaded): 43.6 KB Bytes Out (uploaded): 0.8 KB Request Headers: GET /wiki/dashboard.action HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/xaml+xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, application/x-silverlight, */* Accept-Language: en-us UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648) Host: studio.atlassian.com Connection: Keep-Alive Response Headers: HTTP/1.0 200 OK Date: Tue, 26 Aug 2008 00:20:47 GMT Server: Apache/2.2.3 (CentOS) Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT X-Confluence-Request-Time: 1219710047663 Set-Cookie: JSESSIONID=CBBD6480F3D818BECC559360E12E70CA; Path=/wiki; Secure Set-Cookie: studio.project.rec.used.cookie=; Expires=Wed, 26-Aug-2009 00:20:47 GMT; Path=/ Connection: close Content-Type: text/html;charset=UTF-8
At the end of this request , a cookie for JSESSIONID=CBBD6480F3D818BECC559360E12E70CA, is set with the path /wiki
Request 2:
URL: https://studio.atlassian.com/plugins/servlet/applinks/dynamiccss/studio-colors-css.css Host: studio.atlassian.com IP: 207.223.243.40 Location: Saint Louis, MO* Error/Status Code: 200 Start Offset: 1.457 s Initial Connection: 114 ms SSL Negotiation: 187 ms Time to First Byte: 113 ms Content Download: 0 ms Bytes In (downloaded): 0.9 KB Bytes Out (uploaded): 0.6 KB Request Headers: GET /plugins/servlet/applinks/dynamiccss/studio-colors-css.css HTTP/1.1 Accept: */* Referer: https://studio.atlassian.com/wiki/dashboard.action Accept-Language: en-us UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648) Host: studio.atlassian.com Connection: Keep-Alive Cookie: studio.project.rec.used.cookie= Response Headers: HTTP/1.0 200 OK Date: Tue, 26 Aug 2008 00:20:48 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: JSESSIONID=42F71BE063C754BA92EEA1AA8457A50A; Path=/; Secure ETag: 275 Cache-Control: max-age=300, must-revalidate Vary: User-Agent Connection: close Content-Type: text/css;charset=UTF-8
The next file included has the URL /plugins, so this does not match the previous cookie set on wiki, so is not returned by the browser. The app, sensing this, creates a new JSESSIONID and assigns it the path /
Request 3:
URL: https://studio.atlassian.com/wiki/s/1415/1/1.0/_/download/resources/confluence.web.resources:master-styles/master.css Host: studio.atlassian.com IP: 207.223.243.40 Location: Saint Louis, MO* Error/Status Code: 200 Start Offset: 1.755 s Initial Connection: 83 ms SSL Negotiation: 93 ms Time to First Byte: 124 ms Content Download: 526 ms Bytes In (downloaded): 34.5 KB Bytes Out (uploaded): 0.7 KB Request Headers: GET /wiki/s/1415/1/1.0/_/download/resources/confluence.web.resources:master-styles/master.css HTTP/1.1 Accept: */* Referer: https://studio.atlassian.com/wiki/dashboard.action Accept-Language: en-us UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648) Host: studio.atlassian.com Connection: Keep-Alive Cookie: JSESSIONID=CBBD6480F3D818BECC559360E12E70CA; studio.project.rec.used.cookie=; JSESSIONID=42F71BE063C754BA92EEA1AA8457A50A Response Headers: HTTP/1.0 200 OK Date: Tue, 26 Aug 2008 00:20:48 GMT Server: Apache/2.2.3 (CentOS) Expires: Fri, 24 Aug 2018 00:20:48 GMT Cache-Control: max-age=315360000000 Cache-Control: private Connection: close Content-Type: text/css;charset=UTF-8
Now, we have another request on /wiki, so both cookies match, and both JSESSIONIDs are returned. I have no idea how tomcat parses this, but I would say that any deviation in it's current behavior would lead to unexpected results.