Question

So, I think it is because of the JSESSIONID cookie that is causing the problem, but not too sure, here goes.

Basically, users are required to enter a special token when logging in. But somehow users are able to access the private/member pages even without entering that token.

So user enters credentials minus the token, errors pops up, user ignores it. Of course since there is that error, user is not directed to the members pages. BUT user can manually type in the specific member page and get access to it.

1. user goes to mysite.com/home
2. user enter username/password, no token –> error pops up
3. user ignore the error pop up, enters mysite.com/member/home manually and get access to it

I believe it is the jsessionid, once i remove that cookie the access to the members page are gone as well.

Any ideas?

Answer 1

Actually, it is not jsessionid that is causing the issue, but some weird servlet doing weird stuff…