SWF Flash Uploader invalidates JSESSIONID. Any idea of ​​session recovery on the server side or on the client side?

Question

I use the SWF downloader to download files. I am using java on the server side.

Flash automatically cancels the Java session. The SWF team has not yet found a fix.

After some searching, I found a link discussing the idea of ​​solving this problem in ASP.

In basic PHP, we pass the session identifier as a POST parameter and manually restore the session.

In ASP.Net, we also publish the session identifier and use Global.asax to find values ​​before restoring the session and dynamically adding the right cookies.

Like we have the opportunity to restore a session in java?

I also looked at this https://stackoverflow.com/a/318625/25/16/25/12/14/12/14/12/14/12/14/12/14/12/14/14/12/14/12/14/12/14/12/146/ But I can’t understand exactly what they are saying. Maybe because I did not sound enough in the java session.

Especially upload_url: "Controller?action=33&JSESSIONID=<%=request.getSession().getId()%>", this line. What does he achieve with this line. What is Controller and action=33 .

Any suggestions to restore the session from the client or server will be more valuable.

Thanks!

Answer 1

If I read the related SO question correctly, the problem is not an invalid session identifier, but the way the server relates to the Flash object: it is considered an additional client, and not part of the rest of the browser window. Thus, 2 separate sessions are created, which leads to the fact that the identifier will be different or zero at boot.

The solution is to manually find the correct session identifier or force the server to assign the correct identifier to the new session. This is done by redirecting jsessionid to Flash as a variable and then adding it as a GET parameter to the HTTP download request, so it can be obtained on the server and you can use it to find the correct session.

In this example, the author uses Controller as the name of the servlet, and action=33 is probably used to call some method on it. This is specific to this application, but not important to your decision.

The end of the line is important to you: &jsessionid=<%=request.getSession().getId()%>

This JSP code essentially adds the java session id to a variable containing the URL of the download request. You can do this in simple Java or any other language that has access to the correct session identifier - it is important that it is first passed to the Flash plugin , then added to the download request, then sent to the server again and then used to search or create the correct session identifier to handle loading with.

This is the code that the author used to create a new session cookie:

 if (request.getParameter("JSESSIONID")!=null) { Cookie userCookie = new Cookie("JSESSIONID", request.getParameter("JSESSIONID")); response.addCookie(userCookie); }