Question

I have an Interceptor on Struts2, and I want for some pages to redirect to the ssl version of them.

Example: http://localhost/xhtml/path.do?ossesionid=value1 to https://localhost/xhtml/path.do?ossesionid=value1

For doing this I created a Interceptor that does this:

public String intercept(ActionInvocation invocation) throws Exception {

    // initialize request and response
    final ActionContext context = invocation.getInvocationContext();
    final HttpServletRequest request = (HttpServletRequest) context
            .get(StrutsStatics.HTTP_REQUEST);
    final HttpServletResponse response = (HttpServletResponse) context
            .get(StrutsStatics.HTTP_RESPONSE);

    // check scheme
    String scheme = request.getScheme().toLowerCase();

    // check method
    String method = request.getMethod().toUpperCase();

    // If the action class uses the SSLProtected marker annotation, then see
    // if we need to
    // redirect to the SSL protected version of this page
    if (invocation.getAction() instanceof SSLProtected) {

        if (HTTP_GET.equals(method) && SCHEME_HTTP.equals(scheme)) {

            // initialize https port
            String httpsPortParam = request.getSession().getServletContext().getInitParameter(HTTP_PORT_PARAM);
            int httpsPort = httpsPortParam == null ? HTTPS_PORT : Integer.parseInt(httpsPortParam);

            response.setCharacterEncoding("UTF-8");

            URI uri = new URI(SCHEME_HTTPS, null, request.getServerName(), httpsPort, response.encodeRedirectURL(request.getRequestURI()), request.getQueryString(), null);

            log.debug("Going to SSL mode, redirecting to " + uri.toString());

            response.sendRedirect(uri.toString());
            return null;
        }
    }

My problem is that I expect this

https://localhost/xhtml/path.do?ossesionid=value1

and got

https://localhost/xhtml/path.do;jsessionid=value1?osessionid=value1

And I’m Completly lost! help anyone?

Answer 1

i strongly suggest you to use S2-SSL plugin which is more flexible and provides a much better support to handle switch from SSL to non-SSL and vice-versa.

regarding generation of Jsessionid,JSESSIONID cookie is created/sent when session is created. Session is created when your code calls request.getSession() or request.getSession(true) for the first time. If you just want get session.You have ways to disable the creation of Jsessionid

There are number of way you can disable the creation of this id, please refer to this discussion thread.

I am still not sure what is the problem you are facing with this session-id as it is a very common case in web applications

• is-it-possible-to-disable-jsessionid-in-tomcat-servlet