Enterprise Client Community

Hi,

our application is based on Spring. With an update to the latest spring version the StrictHttpFirewall of Spring is complaining about some characters in a HttpServletRequest. E.g. the ";"

When we use the fileupload button after selecting an image and click on ok a HttpServletRequest with a RequestURL:

Code:

 "/my_application/ccupload/UPLOAD_1534835327090_2_slice_0_of_2.ccupload;jsessionid=5DDCC9AE4D3077F70779E0E55BCF421B"

is received. That request contains a ";" when adding the jsessionid. Is that something which is required or can this be concatenated with a different character like "&" or so?

Hi,
this is absolutely required if not running in COOKIE-mode. Ths ";jsessionid=" is the default way of writing session information into the URL. So I am a bit "confused" that Spring does not like it...
Regards, Björn

Ok I see. So I guess that topic is erased when we switch to yummy cookies right?

...from my understanding: yes...! ;-) - Björn

Just saw that when we use the client side printing we get:

Code:

 /my_app/ccbuffer/BUFFERED_1534838551886_1.ccbuffer/document.pdf;jsessionid=DD64DDA872BBAC89D97FDD9A00D2E378;filename=/document.pdf

Then this filename=/document.pdf would still be concatenated with ";" right?

Hi,

you are right...! And this we also do following some convention... - But this in our hands, so we could switch off.

Regards, Björn

As a workaround we could also enable ";" but... You know. Not the preferred way

I don't know why Spring suddenly dropped support of ";" (I'll find out) but if we could turn it off somehow it would be the best for us regarding security.

Hello,

we had the same problem with spring security enabled. And we actually took the "easy" way and allowed semicolon in the URL.

Code:

 @Configuration
 @EnableWebSecurity
 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
     @Override
     public void configure(WebSecurity web) throws Exception {
         web.ignoring().anyRequest();
         web.httpFirewall(allowUrlEncodedSlashHttpFirewall());
     }
 
     @Bean
     public HttpFirewall allowUrlEncodedSlashHttpFirewall() {
         StrictHttpFirewall firewall = new StrictHttpFirewall();
         firewall.setAllowSemicolon(true);
         return firewall;
     }
 
 }

Yes I currently did that too as a workaround but since our application requires higher security I'm afraid that this won't be the solution :/