338278 - Mozilla browsers doesn't work very good with Apache Struts Token

Status: RESOLVED DUPLICATE of bug 117222

(Core :: Networking: Cookies, defect)

Description

[Ting Chen]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3

To avoid to submit a form twice, Apache Struts uses a mechanism they called it Token. Everytime when an action is performed, Struts generates a token and stores it in the server session. The same token is submitted to the browser. When the form is submitted, the token is sent back with the request and the Struts compares this token with the token it has saved in session.

When two or more instances of FireFox or Mozilla is opend, then the above mechanism no more works. The reason is that FireFox and Mozilla use the same session for all its instances. So if one instance makes a submit, than Struts would generate a token and send it back to this instance. But when the other instance makes a submit, Struts would generate another token and send it to the second instance. When the first instance now send a submit, its token no more matches the token that Struts has saved in the session.

Reproducible: Always

Comment 1

[Charli Li (winsxs)]

What in the heck is the Apache Struts Token anyway???

Comment 2

[Charli Li (winsxs)]

Also, besides this bug you reported, please also report this exact same situation in the "Report Broken Website" feature [in both Mozilla and Firefox].

Comment 3

[Dave Townsend [:mossop]]

As you correctly identified the problem is that the session cookies are shared across all windows and tabs of the application. Duping this to the request for that to change.

There is no need to report this using the broken website tool, this is not a problem with the website but a limitation in how mozilla apps currently work.


*** This bug has been marked as a duplicate of 117222 ***