topic Re: [Solved] Security problem : sending an alfresco link in Alfresco Archive

[Solved] Security problem : sending an alfresco link

zomurn — Mon, 02 Feb 2009 09:22:29 GMT

Hi everyone,I deployed an alfresco application and a server host it. The application is accessible by all employees through intranet via URL http://xx.xx.xxx.xx/alfresco.I have a security problem with the application (It an Alfresco 2.2.0 enterprise installed). Scenario :1) A user access the applica

Re: [Solved] Security problem : sending an alfresco link

zomurn — Mon, 02 Feb 2009 13:58:33 GMT

I precise that the navigator of the client is ie6.

Re: [Solved] Security problem : sending an alfresco link

zomurn — Wed, 04 Feb 2009 09:45:48 GMT

As I used to, I'am going to answer to myself ; it might help somebody.
The problem comes from client side : the client store in cache (more precisely in cookies) the pages login.jsp and browse.jsp.
So when we copy/paste the URL browse.jsp into the navigator, the navigator display the cached browse.jsp.
To solve this problem, we need to force the navigator NOT TO CACHE the browse.jsp page (login.jsp is not important).
Hence, we need to add at the begin of browse.jsp page the scriplet :


<%
response.addHeader("Pragma", "no-cache");
response.addHeader("Cache-Control", "no-cache");
response.addHeader("Cache-Control", "must-revalidate");
%>‍‍‍‍‍‍

and then we can see that in windows cookie, the browse.jsp doesn't appear anymore.