PM81933: ENCODEURL NOT WORKING PROPERLY WHEN THERE IS ANY COOKIE IN THE REQUEST HEADER

8.0.0.7: WebSphere Application Server V8.0 Fix Pack 7
8.0.0.8: WebSphere Application Server V8.0 Fix Pack 8
8.0.0.9: WebSphere Application Server V8.0 Fix Pack 9
8.0.0.10: WebSphere Application Server V8.0 Fix Pack 10
8.0.0.11: WebSphere Application Server V8.0 Fix Pack 11
8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15

APAR status

• Closed as program error.

Error description

• The HTTP session manager checks for an existence of ANY cookie
  in request header and does not encode the URL properly.
  
  Problem scenario:
  - Both "Enable cookies" and "Enable URL rewriting" options are
  enabled
  - Browser does not accept cookie
  - If some tool in between browser and WebSphere Application
  Server inserts its own cookie Application Server does not
  encode the URL.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server Version    *
  *                  8, and 8.5 users.                           *
  ****************************************************************
  * PROBLEM DESCRIPTION: When invoking the                       *
  *                      javax.servlet.http.HttpServletResponse. *
  *                      encodeURL() method, the session         *
  *                      manager may not encode the session      *
  *                      identifier when it is expected.         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When url encoding is enabled, the session manager will not
  include the session identifier when cookies are allowed by the
  browser.  This causes confusion as some expect it to be
  excluded only if the session cookie is present.
  

Problem conclusion

• The WebSphere Application Server session manager will add a
  new custom property, CheckSessionCookieNameOnEncodeURL
  (default=false). Set this property to true to enable the
  Session Manager to only check for the existence of the HTTP
  session cookie when determining whether the session ID needs
  to be encoded in the URL.
  
  Here are the steps for setting the custom property
  for session management at the server level:
      In the administrative console click Servers > Server Types
  > WebSphere application servers > server_name > Session
  management.
      Under Additional Properties select Custom Properties.
      On the Custom Properties page, click New.
      On the settings page, enter
  CheckSessionCookieNameOnEncodeURL
  in the Name field and true in the Value field.
      Click Apply or OK.
      Click Save on the console task bar to save your
  configuration changes.
      Restart the server.
  
  The fix for this APAR is currently targeted for inclusion in
  fix packs 8.0.0.7 and 8.5.5.1.
  Please refer to the Recommended Updates page for delivery
  information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  PM89843

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R800 PSY

     UP

• R850 PSY

     UP