Details
-
Improvement
-
Status: Closed
-
Normal
-
Resolution: Fixed
-
r2.06.06 (m13 - rc7)
-
None
-
None
Description
This can be a potential problem for:
- health checking systems
- forward proxies which doe heads and gets (virus scan) without session cookies
- (d)dos-ing the cms by hammering the login page
Example http log for scenario 2:
xx.xx.9.48 - - [21/Jul/2009:11:19:19 +0200] "HEAD /?wicket:interface=:1:root:pinger::IActivePageBehaviorListener:0:1&wicket:ignoreIfNotActive=true&random=0.3196154454845901 HTTP/1.0" 200 - "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
xx.xx.9.48 - - [21/Jul/2009:11:19:19 +0200] "GET /?wicket:interface=:1:root:pinger::IActivePageBehaviorListener:0:1&wicket:ignoreIfNotActive=true&random=0.3196154454845901 HTTP/1.0" 200 7150 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
xx.xx.9.48 - - [21/Jul/2009:11:19:19 +0200] "GET /?wicket:interface=:1:root:pinger::IActivePageBehaviorListener:0:1&wicket:ignoreIfNotActive=true&random=0.3196154454845901 HTTP/1.0" 200 797 "" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10"
Attachments
Issue Links
- causes
-
CMS-2919 Fix exception thrown by JackRabbit about session not closed
- Closed