{"action":"created","issue":{"url":"https://api.github.com/repos/apereo/java-cas-client/issues/177","repository_url":"https://api.github.com/repos/apereo/java-cas-client","labels_url":"https://api.github.com/repos/apereo/java-cas-client/issues/177/labels{/name}","comments_url":"https://api.github.com/repos/apereo/java-cas-client/issues/177/comments","events_url":"https://api.github.com/repos/apereo/java-cas-client/issues/177/events","html_url":"https://github.com/apereo/java-cas-client/issues/177","id":170108701,"number":177,"title":"Every other request incorrectly gatewayed","user":{"login":"OlivierJaquemet","id":618861,"avatar_url":"https://avatars.githubusercontent.com/u/618861?v=3","gravatar_id":"","url":"https://api.github.com/users/OlivierJaquemet","html_url":"https://github.com/OlivierJaquemet","followers_url":"https://api.github.com/users/OlivierJaquemet/followers","following_url":"https://api.github.com/users/OlivierJaquemet/following{/other_user}","gists_url":"https://api.github.com/users/OlivierJaquemet/gists{/gist_id}","starred_url":"https://api.github.com/users/OlivierJaquemet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OlivierJaquemet/subscriptions","organizations_url":"https://api.github.com/users/OlivierJaquemet/orgs","repos_url":"https://api.github.com/users/OlivierJaquemet/repos","events_url":"https://api.github.com/users/OlivierJaquemet/events{/privacy}","received_events_url":"https://api.github.com/users/OlivierJaquemet/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-08-09T08:26:16Z","updated_at":"2016-08-10T12:22:32Z","closed_at":null,"body":"When using a gateway, request are not constantly being processed in the same way.\r\n\r\n```\r\n// First request not gatewayed\r\nSession[\"_const_cas_gateway_\"] = null\r\nRequest1 : AuthenticationFilter --> gateway.hasGatewayedAlready  // wasGatewayed = false\r\nSession[\"_const_cas_gateway_\"] = null\r\nRequest1 : AuthenticationFilter --> gateway.storeGatewayInformation                         \r\nSession[\"_const_cas_gateway_\"] = \"yes\"\r\n\r\n// Second consecutive request, expected not to be gatewayed/redirected\r\nRequest2 : AuthenticationFilter --> gateway.hasGatewayedAlready  // wasGatewayed = true\r\nSession[\"_const_cas_gateway_\"] = null\r\n\r\n// Third consecutive request, expected not to be gatewayed/redirected\r\n// BUG ?? because request2 has invoked hasGatewayedAlready, the session attribute has been removed and a redirection occurs\r\nRequest3 : AuthenticationFilter --> gateway.hasGatewayedAlready  // wasGatewayed = false\r\nSession[\"_const_cas_gateway_\"] = null\r\nRequest3 : AuthenticationFilter --> gateway.storeGatewayInformation                         \r\nSession[\"_const_cas_gateway_\"] = \"yes\"\r\n```\r\n\r\nPossible explanation : \r\nDefaultGatewayResolverImpl.hasGatewayedAlready does not only read the session attribute, it also removes it, which may lead to concurrency issue if several request of the same session are \r\nrun consecutively/concurrently ( see example for Request 1 and Request 2 below) \r\n\r\nPull request with unittest and fix soon incomming..."},"comment":{"url":"https://api.github.com/repos/apereo/java-cas-client/issues/comments/238850273","html_url":"https://github.com/apereo/java-cas-client/issues/177#issuecomment-238850273","issue_url":"https://api.github.com/repos/apereo/java-cas-client/issues/177","id":238850273,"user":{"login":"OlivierJaquemet","id":618861,"avatar_url":"https://avatars.githubusercontent.com/u/618861?v=3","gravatar_id":"","url":"https://api.github.com/users/OlivierJaquemet","html_url":"https://github.com/OlivierJaquemet","followers_url":"https://api.github.com/users/OlivierJaquemet/followers","following_url":"https://api.github.com/users/OlivierJaquemet/following{/other_user}","gists_url":"https://api.github.com/users/OlivierJaquemet/gists{/gist_id}","starred_url":"https://api.github.com/users/OlivierJaquemet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OlivierJaquemet/subscriptions","organizations_url":"https://api.github.com/users/OlivierJaquemet/orgs","repos_url":"https://api.github.com/users/OlivierJaquemet/repos","events_url":"https://api.github.com/users/OlivierJaquemet/events{/privacy}","received_events_url":"https://api.github.com/users/OlivierJaquemet/received_events","type":"User","site_admin":false},"created_at":"2016-08-10T12:22:32Z","updated_at":"2016-08-10T12:22:32Z","body":"@battags absolutely, consecutive or concurrent request of the same session. For example, it can occurs if a protected page includes other resources in a protected area. A fictive example would be something like : \r\n```\r\n<html>\r\n   [...]\r\n    <script src=\"protected.js\" type=\"text/javascript\"></script>\r\n    <link rel=\"stylesheet\" href=\"protected.css\" type=\"text/css\" />\r\n    <img src=\"protected-image.png\" [...] />\r\n   [...]\r\n</html>\r\n```\r\n\r\n@serac I don't have enough knowledge and understanding of the protocol to see if it would be a correct approach.\r\nDid you check my PR and the unittest ? Tying the check to a unique attribute of the session like the original implementation did seems just fine to me. The only mistake I could spot was removing this attribute for each request check.  I don't fully understand why the existing implementation was coded this way."}}
{"actor":{"display_login":"OlivierJaquemet"}}