Back button issue

[Cantor, Scott]

> My hunch is that this is somehow JSESSIONID related, but I'm
> looking for more data about why this issue is happening.

I'd be more focused on tracing requests and cookies, the log's not going to tell you anything it didn't already tell you. It can't, there's nothing there for it to elaborate on, it has no state to log.

I know of no causes other than the ones I stated, and I didn't think there was anything unusual about listing them. Mostly in case I'm forgetting one somebody can point to, but I also forgot to note that the client can easily cause all sorts of issues when it isn't compliant, they just end up being one of the actual causes I mentioned in the end.

Chrome for example is very broken, and it can cause the JSESSIONID issue because it sometimes issues duplicate requests and mis-associates the cookies it gets back. If it sends two requests, gets back two different cookies, but holds on to the first one and sends it back later on, the server has moved on to the second and so it's out of sync. There's nothing the server can do about it.

That's just a specific case of the JSESSIONID not lining up.

It does similar thiings with form contents, which is why it broke the CSRF support we built in in a similar way by holding on to the wrong CSRF token.

In your example, something else is probably going on that coincides with that sequence of steps but it isn't directly caused by them, at least not if that's actual exception. As I said, that error page is a catch all for lots of different scenarios and different logged exceptions. That exception is probably one of the "simpler" ones that manifests.

-- Scott