Posted by Joel Oates on
URL: https://discuss.orbeon.com/Invalid-JSESSIONID-When-Open-new-Form-From-Within-a-Form-tp4665143.html

Hey All,

I have run into an issue into what looks like the JSESSIONID cookie not
being forwarded when loading a new form. I have a link on a form that will
open a new form in another window using the xf:load.

Now when I try and load that form using the following:
<xf:load
resource="{xxf:property('im.rest.uri.workflow-host')}/{instance('create_docuemnt_query_resource')/viewUrl}"
show="new"/>


It loads the new form up fine, however the form that launched that form is
now getting Unauthorised (403) in the `Referrer` form.

I had a look at  this
<https://doc.orbeon.com/configuration/advanced/session>   I have the
following in my properties-local.xml
<property as="xs:string" name="oxf.http.forward-cookies" value="JSESSIONID
JSESSIONIDSSO" />

I did some hunting and I found that that the JSESSIONID cookie is not being
forwarded when loading the new form.
Here are my findings of the JSESSIONID not being forwarded.

I am using WireShark to hunt down the requests here is my full dump for
reference. (Red = Client, Blue = Server)
OrbeonFormRequest.pdf
<http://discuss.orbeon.com/file/t375722/OrbeonFormRequest.pdf>  

The request to trigger the event has the JSESSIONID and the JSESSIONIDSSO,

Cookie: JSESSIONID=U-cBf1-upiVvnl7bMZBXdq_rGyUbEpfbhnGFb5QW.joates-pc;
JSESSIONIDSSO=itX04tXbaFWFghS9hLNwcUB80D5JwqC3bzSQZ5xu

 That's all good, then the server responds and we then trigger the GET
request to go get the new form only the  JSESSIONIDSSO is present in the
Cookies

Cookie: JSESSIONIDSSO=itX04tXbaFWFghS9hLNwcUB80D5JwqC3bzSQZ5xu

So as expected the server sends a Set-Cookie:
Set-Cookie: JSESSIONID=dBAnPKFRKvT8yofK88hMxjgSidyZdlxF6OfsHFaT.joates-pc;
path=/workflow-orbeon

Now when I go back to my 'parent' form anything I do is with the new
JSESSIONID that does not know about the UUID of that form.
As you can see from the last client request

Cookie: JSESSIONID=dBAnPKFRKvT8yofK88hMxjgSidyZdlxF6OfsHFaT.joates-pc;
JSESSIONIDSSO=itX04tXbaFWFghS9hLNwcUB80D5JwqC3bzSQZ5xu

and server response
<error><title>Unknown form document requested.</title></error>

Is this something to to do with using xf:load? or is this possible? I am not
sure how this is different to opening two forms and using them both. (Other
then the Set-Cookie Request)

I hope this makes sense...

Joel.


--
Sent from: http://discuss.orbeon.com/

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To view this discussion on the web visit https://groups.google.com/d/msgid/orbeon/1586075540327-0.post%40n4.nabble.com.