[jira] [Commented] (OFBIZ-4645) <link> creates links without jsessionid for users who have cookies disabled

[Nicolas Malin (Jira)]

    [ https://issues.apache.org/jira/browse/OFBIZ-4645?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15054786#comment-15054786 ]

Jacques Le Roux commented on OFBIZ-4645:
----------------------------------------

Also a very interesting complement for those who doubt https://www.owasp.org/index.php/Session_Management_Cheat_Sheet

> <link> creates links without jsessionid for users who have cookies disabled
> ---------------------------------------------------------------------------
>
>                 Key: OFBIZ-4645
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4645
>             Project: OFBiz
>          Issue Type: Bug
>          Components: framework
>    Affects Versions: Trunk
>            Reporter: Christoph Neuroth
>
> HtmlMenuRenderer.renderLink uses WidgetWorker.buildHyperlinkUrl to construct the URL. Other parts of OfBIZ use RequestHandler.makeLink. The latter will include the jsessionid as a parameter in the generated URL if neccessary (i.e. cookies are not available), but the former does not. Because of this, all links that are rendered using the <link> tag in an XML Form definition will send the user back to the login page.

--
This message was sent by Atlassian JIRA
(v6.3.4#6332)