Spring MVC and Jetty: Prevent jsessionid from being used in RedirectView when redirecting to an external site

Question

In Spring MVC 2.5 with Jetty - possibly with any servlet container - I want to redirect to an external site using RedirectView using the magic redirect: prefix: for the view name in ModelAndView.

Unfortunately, RedirectView uses response.encodeRedirectURL (), so my (other request) session id is appended to the url. Not only does the security risk transfer the session identifier to an external site, the string "; jsessionid = gagnbaba" can also be interpreted as part of ContextPath / PathInfo on another site, resulting in poor URLs.

Any spring options other than implementing my own ExternalRedirectView ..., and also crack the ViewResolver to interpret the "externalRedirect:" prefix? (Requiring cookies is not an option.)

Moritz

Answer 1

Now here is the ExternalRedirectView, as planned in my comment above ... did just that.

import java.io.IOException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.web.servlet.view.RedirectView;

/** variant of RedirectView, will not add a session id to the url
 */
public class ExternalRedirectView extends RedirectView {
    public ExternalRedirectView(String url, boolean contextRelative) {
        super(url, contextRelative);
    }

    /** copied from @link{RedirectView#sendRedirect} and removed calls to
     * reponse.encodeRedirectURL()
     */
    @Override
    protected void sendRedirect( HttpServletRequest request,
            HttpServletResponse response, String targetUrl,
            boolean http10Compatible ) throws IOException {
        if (http10Compatible) {
            // Always send status code 302.
            response.sendRedirect(targetUrl);
        }
        else {
            // Correct HTTP status code is 303, in particular for POST requests.
            response.setStatus(303);
            response.setHeader("Location", targetUrl);
        }
    }
}

I also had my own ViewResolver, in which I added the functionality of the new externalRedirect: magic vier prefix, which now reads:

class MyViewResolver extends AbstractCachingViewResolver implements BeanFactoryAware {
[...]
    private static final String EXTERNAL_REDIRECT_URL_PREFIX = "externalRedirect:";
[...]
    @Override
    protected View loadView( String viewName, Locale locale ) throws Exception {
        View view;
        if (viewName.startsWith(UrlBasedViewResolver.REDIRECT_URL_PREFIX)) 
        {
            view = new RedirectView(viewName.substring(UrlBasedViewResolver.REDIRECT_URL_PREFIX.length()), true);
        }
        else if (viewName.startsWith(EXTERNAL_REDIRECT_URL_PREFIX)) 
        {
            view = new ExternalRedirectView(viewName.substring(EXTERNAL_REDIRECT_URL_PREFIX.length()), true);
        }
        else 

[...] Thanks to everyone who read this and thought about it.