DWR SecurityException：POST请求中的HttpSessionId为空

Question

I am trying to upgrade Tomcat 5.5 + JDK 5 to Tomcat 8.5.x + JDK 1.7 The application that is deployed on this server is a legacy application which uses FTL (2.3.4) + DWR(2.0.3) + Spring (2.5.5) frameworks

When deployed on Tomcat 8.5.6 + JDK 7 I am getting errors on few actions which perform POST request from the application. Most of these actions are DWR calls for filtering/manipulation of data displayed on the screen.

There is a popup message "Session Error" displayed on screen. On front end profiling I found that the complete error is a SecurityException which results into SessionError.

Session Error - SecurityException

When debugged on server side I found out that the request was being treated as a CSRF attack and hence this exception was thrown. DWR checks for the HTTP session ID in the body of the POST request to validate the request against CSRF possibility. So in front end debugging I found that the request is not sending the httpSessionId in the POST body.

Request header and body are as shown here.

I have tried disabling the crossDomainSessionSecurity parameter in DWR servlet initialization. It works fine after that, but I cannot go ahead with the security risk it poses in the production environment.

Due to this issue I am not able to go ahead with the Tomcat migration. Please suggest how can I resolve this issue?

Answer 1

I was checking for some new features in Tomcat 8. I read that from Tomcat 6 onwards Tomcat allows only HTTP requests by default. Which means that the useHttpOnly flag is true by default. This causes the javascript requests to fail. In the deployment I tried by setting the useHttpOnly=”false” and the application works fine after that. I will do more tests on my side, so for now we can consider this issue to be resolved.