Closed
Bug 145977
Opened 24 years ago
Closed 24 years ago
Login problems with sites secured by LTPA
Categories
(Core :: Security, defect)
Tracking
()
RESOLVED
INVALID
People
(Reporter: markp, Assigned: security-bugs)
References
()
Details
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc2)
Gecko/20020510
BuildID: 2002051006
I have a site that is served by WebSphere 4.0.2 and is secured via LDAP using
LTPA. I can login and access the site fine. Logging in creates an LTPA token
that is set to expire when the session expires. I can see this token in Cookie
Manager.
The problem happens after I logout from the site. The logout action invalidates
the session on the server but it apparently does not invalidate the LTPA token
in the browser. If I try to reenter the site, I am not brought to the login
page, instead it tries to go in to the site directly.
If Quick Launch is enabled, this problem even exists if I close and reopen the
browser. If Quick Launch is not enabled, closing and reopening the browser
resolves the problem.
Reproducible: Always
Steps to Reproduce:
1. Login to site protected by LTPA.
2. Logout.
3. Try to access site again. You are not brought to login page due to presence
of LTPA token from previous session.
Actual Results: The presence of the LTPA token caused the browser to not be
directed to the login page. However, since the login does not take place it
cannot access the protected resource. In essence, the client thinks it is
logged in, but the server thinks otherwise.
Expected Results: In all versions of IE, the second attempt to access the site
will redirect the user back to the login page.
This problem is compounded by Quick Launch. With Quick Launch enabled, closing
the browser does not fix the problem.
The problem happens over http and https.
|
||
Comment 1•24 years ago
|
||
Reporter, could you please confirm with a current build?
|
|
Reporter | |
Comment 2•24 years ago
|
||
Yes, the problem still happens. It is really hard to know if it is a Mozilla
problem, or a WebSphere problem. I will be applying the latest WebSphere
patches soon and will retest then.
FWIW, I do not get this problem in IE.
|
|
Reporter | |
Comment 3•24 years ago
|
||
You can close this bug. After getting the latest version of WebSphere applied,
the problem has gone away. I think it was caused by some bugs in the WebSphere
form-based login/logout servlets.
Status: UNCONFIRMED → RESOLVED
Closed: 24 years ago
Resolution: --- → INVALID
You need to log in
before you can comment on or make changes to this bug.
Description
•