Bug 47466

Summary:	Page session="false" directive ignored in include-prelude JSP
Product:	Tomcat 6	Reporter:	Damien Papworth <damien>
Component:	Jasper	Assignee:	Tomcat Developers Mailing List <dev>
Status:	RESOLVED DUPLICATE
Severity:	normal
Priority:	P2
Version:	6.0.20
Target Milestone:	default
Hardware:	Macintosh
OS:	Mac OS X 10.4
Attachments:	Example war consisting of the above web.xml and JSP files

Description Damien Papworth 2009-07-02 04:01:22 UTC

Created attachment 23920 [details]
Example war consisting of the above web.xml and JSP files

Page session directive appears to be ignored when specified in include-prelude declarations. For example, the following configuration should ensure that JSP pages do not create sessions. This works in 6.0.14, but not in 6.0.20 (I've not test 6.0.18 yet).

/WEB-INF/web.xml:
<?xml version="1.0"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
         version="2.4">
  <jsp-config>
    <jsp-property-group>
      <url-pattern>*.jsp</url-pattern>
      <include-prelude>/WEB-INF/prelude.jsp</include-prelude>
    </jsp-property-group>
  </jsp-config>
</web-app>

/WEB-INF/prelude.jsp:
<%@ page session="false" %>

/index.jsp:
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
  <title>Session Test</title>
</head>
<body>
<%  if (null != request.getSession(false)) {
      %>Session present<%
    } else {
      %>Session not present<%
    }%>
</body>
</html>

I've attached a sample WAR file containing the above files. Under 6.0.20, the output will be 'Session present', whereas in 6.0.14 the output will be 'Session not present'.

Has the behaviour of preludes been intentionally changed in 6.0.20? I've not seen any specific in the change logs between versions.

Comment 1 Mark Thomas 2009-07-02 05:02:54 UTC


*** This bug has been marked as a duplicate of bug 47318 ***