ff4j icon indicating copy to clipboard operation
ff4j copied to clipboard

Do not create session in web console

Open bjab opened this issue 4 years ago • 0 comments

I think that forcing session creation here is unnecessary. When combined with spring secruity, session creation in some cases it will render all links with ;jsessionid=... and spring will reject those links as security breach (The request was rejected because the URL contained a potentially malicious String ";")

You can obtain servletContext by request.getServletContext() call

https://github.com/ff4j/ff4j/blob/a31cb8caf8b8c4874fcd6bb64893f4f50919af3c/ff4j-web/src/main/java/org/ff4j/web/controller/AbstractController.java#L159 https://github.com/ff4j/ff4j/blob/a31cb8caf8b8c4874fcd6bb64893f4f50919af3c/ff4j-web/src/main/java/org/ff4j/web/controller/AbstractController.java#L204

bjab avatar Mar 12 '21 08:03 bjab