ICEfaces
  1. ICEfaces
  2. ICE-8720

Detect and handle login page response to ajax requests

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: EE-3.0.0.GA_P01, 3.2
    • Fix Version/s: EE-3.2.0.BETA, EE-3.2.0.GA, 3.3
    • Component/s: Framework
    • Labels:
      None
    • Environment:
      ICEfaces, authentication
    • Salesforce Case Reference:
    • Affects:
      Documentation (User Guide, Ref. Guide, etc.), Compatibility/Configuration

      Description


      Container-managed authentication typically returns a Location: header redirect which results in a login page being returned in place of an ajax update. This scenario should be detected and the login page should be displayed.

        Activity

        Hide
        Ted Goddard added a comment - - edited

        Past versions of ICEfaces would apply the non-xml response directly to the page, but this would not render correctly in some cases due to the different processing by the browser.
        A better approach would be to look at the referrer or a custom header so that when the bridge detects an html ajax response, the header would be inspected, or a custom marker within the html page would be inspected, and a redirect to that page would occur. The easiest approach for the application developer is likely to put a URL marker within the login page itself.

        Show
        Ted Goddard added a comment - - edited Past versions of ICEfaces would apply the non-xml response directly to the page, but this would not render correctly in some cases due to the different processing by the browser. A better approach would be to look at the referrer or a custom header so that when the bridge detects an html ajax response, the header would be inspected, or a custom marker within the html page would be inspected, and a redirect to that page would occur. The easiest approach for the application developer is likely to put a URL marker within the login page itself.
        Hide
        Ted Goddard added a comment - - edited

        POST /jsecurity/faces/protected/protected.xhtml HTTP/1.1
        Host: localhost:8080
        Connection: keep-alive
        Content-Length: 657
        Faces-Request: partial/ajax
        Origin: http://localhost:8080
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.16 (KHTML, like Gecko) Chrome/24.0.1305.3 Safari/537.16
        Content-type: application/x-www-form-urlencoded;charset=UTF-8
        Accept: /
        Referer: http://localhost:8080/jsecurity/faces/protected/protected.xhtml
        Accept-Encoding: gzip,deflate,sdch
        Accept-Language: en-US,en;q=0.8
        Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
        Cookie: JSESSIONID=E4E01F16A7CE64B758FEEF9E450AD168; ice.push.browser=1h97k1c9n; ice.connection.contextpath=/jsecurity; ice.connection.running=c63b6:acquired; ice.connection.lease=1352240589889
        form=form&ice.window=5th97l2h3x&ice.view=vb6mwsp9&javax.faces.ViewState=-4214835742458922795%3A873485868798462855&javax.faces.source=form%3AcarTable&javax.faces.partial.execute=form%3AcarTable&javax.faces.partial.render=form%3AcarTable&ice.window=5th97l2h3x&ice.view=vb6mwsp9&ice.focus=&ice.event.target=&ice.event.captured=form%3AcarTable&ice.event.type=onclick&ice.event.alt=false&ice.event.ctrl=false&ice.event.shift=false&ice.event.meta=false&ice.event.x=783&ice.event.y=102&ice.event.left=false&ice.event.right=false&form%3AcarTable=form%3AcarTable&form%3AcarTable_paging=true&form%3AcarTable_rows=2&form%3AcarTable_page=2&javax.faces.partial.ajax=true
        HTTP/1.1 200 OK
        Server: Apache-Coyote/1.1
        Set-Cookie: JSESSIONID=129E3DBF030FCA0F962BD41722D394C7; Path=/jsecurity/; HttpOnly
        X-Powered-By: JSF/2.0
        Cache-Control: no-cache
        Content-Type: text/xml;charset=UTF-8
        Content-Length: 276
        Date: Tue, 06 Nov 2012 22:23:08 GMT
        <?xml version='1.0' encoding='UTF-8'?>
        <partial-response><changes><update id="javax.faces.ViewState"><![CDATA[8157311465288573389:-7796284620318046102]]></update><extension aceCallbackParam="validationFailed">

        {"validationFailed":false}

        </extension></changes></partial-response>
        This does not seem to be applying authentication to the POST request, so will add the following to web.xml under <web-resource-collection>:
        <http-method>GET</http-method>
        <http-method>POST</http-method>

        Show
        Ted Goddard added a comment - - edited POST /jsecurity/faces/protected/protected.xhtml HTTP/1.1 Host: localhost:8080 Connection: keep-alive Content-Length: 657 Faces-Request: partial/ajax Origin: http://localhost:8080 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.16 (KHTML, like Gecko) Chrome/24.0.1305.3 Safari/537.16 Content-type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Referer: http://localhost:8080/jsecurity/faces/protected/protected.xhtml Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=E4E01F16A7CE64B758FEEF9E450AD168; ice.push.browser=1h97k1c9n; ice.connection.contextpath=/jsecurity; ice.connection.running=c63b6:acquired; ice.connection.lease=1352240589889 form=form&ice.window=5th97l2h3x&ice.view=vb6mwsp9&javax.faces.ViewState=-4214835742458922795%3A873485868798462855&javax.faces.source=form%3AcarTable&javax.faces.partial.execute=form%3AcarTable&javax.faces.partial.render=form%3AcarTable&ice.window=5th97l2h3x&ice.view=vb6mwsp9&ice.focus=&ice.event.target=&ice.event.captured=form%3AcarTable&ice.event.type=onclick&ice.event.alt=false&ice.event.ctrl=false&ice.event.shift=false&ice.event.meta=false&ice.event.x=783&ice.event.y=102&ice.event.left=false&ice.event.right=false&form%3AcarTable=form%3AcarTable&form%3AcarTable_paging=true&form%3AcarTable_rows=2&form%3AcarTable_page=2&javax.faces.partial.ajax=true HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=129E3DBF030FCA0F962BD41722D394C7; Path=/jsecurity/; HttpOnly X-Powered-By: JSF/2.0 Cache-Control: no-cache Content-Type: text/xml;charset=UTF-8 Content-Length: 276 Date: Tue, 06 Nov 2012 22:23:08 GMT <?xml version='1.0' encoding='UTF-8'?> <partial-response><changes><update id="javax.faces.ViewState"><![CDATA [8157311465288573389:-7796284620318046102] ]></update><extension aceCallbackParam="validationFailed"> {"validationFailed":false} </extension></changes></partial-response> This does not seem to be applying authentication to the POST request, so will add the following to web.xml under <web-resource-collection>: <http-method>GET</http-method> <http-method>POST</http-method>
        Hide
        Jack Van Ooststroom added a comment - - edited

        Sending core/src/main/java/org/icepush/servlet/ICEpushServlet.java
        Transmitting file data .
        Committed revision 32174.

        Show
        Jack Van Ooststroom added a comment - - edited Sending core/src/main/java/org/icepush/servlet/ICEpushServlet.java Transmitting file data . Committed revision 32174.
        Hide
        Jack Van Ooststroom added a comment - - edited

        Assigning to Mircea

        Show
        Jack Van Ooststroom added a comment - - edited Assigning to Mircea
        Hide
        Mircea Toma added a comment - - edited

        The fix applied modifies the bridge to reload the current page when detecting that HTML markup is returned instead of partial update. This in effect re-runs the HTTP 30* redirection that is sent from the server.
        In the case of the login page the current page is reloaded thus triggering the server to redirect to login page which is sent back to the browser, which in this case loads the page normally (not as an partial update).
        The only caveat is that the login page needs to be setup as an XHTML page so that it is XML parsed when the AJAX response is received.

        Show
        Mircea Toma added a comment - - edited The fix applied modifies the bridge to reload the current page when detecting that HTML markup is returned instead of partial update. This in effect re-runs the HTTP 30* redirection that is sent from the server. In the case of the login page the current page is reloaded thus triggering the server to redirect to login page which is sent back to the browser, which in this case loads the page normally (not as an partial update). The only caveat is that the login page needs to be setup as an XHTML page so that it is XML parsed when the AJAX response is received.
        Hide
        Jack Van Ooststroom added a comment - - edited

        As we've been able to confirm the fix working on both Tomcat and WebLogic Server I'll mark this one as FIXED.

        Show
        Jack Van Ooststroom added a comment - - edited As we've been able to confirm the fix working on both Tomcat and WebLogic Server I'll mark this one as FIXED.
        Hide
        Mircea Toma added a comment -

        Introduced org.icefaces.reloadOnUpdateFailure configuration parameter and corresponding implementation to allow the bridge to reload the current page whenever the returned response doesn't contain a proper partial update.

        Show
        Mircea Toma added a comment - Introduced org.icefaces.reloadOnUpdateFailure configuration parameter and corresponding implementation to allow the bridge to reload the current page whenever the returned response doesn't contain a proper partial update.
        Hide
        Ken Fyten added a comment -

        Config. param needs to be added to the doc wiki.

        Show
        Ken Fyten added a comment - Config. param needs to be added to the doc wiki.
        Hide
        Mircea Toma added a comment -

        Force browser to load current URL instead of reloading the page to avoid browser popup on reload after POST request.

        Show
        Mircea Toma added a comment - Force browser to load current URL instead of reloading the page to avoid browser popup on reload after POST request.

          People

          • Assignee:
            Jack Van Ooststroom
            Reporter:
            Ted Goddard
          • Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: