Re: Question about cookies returned during markup operations

[Nathan Lipke <nathan.lipke@oracle.com>]

After discussing this on the Interfaces SC call (we should probably re-discuss it on an Interop SC and/or TC call):

The committee has not discussed how cookies set on any markup call other than initCookie() (getMarkup(), performBlockingInteration(), getResource(), proxied resource calls) should be handled. That being said those on the call thought my interpretation is probably reasonable (see below) should be discussed and a clarification note is needed;

My interpretation is:
It depends on the value of the CookieProtocol in the service description as follows:

• none - each portlet has its own cookies
• perUser - all portlets on a given producer share cookies
• perGroup - all portlets in a group share cookies.

In particular, I'm interested in this case:

• The producer specifies a cookie protocol of "none".
  
• Then on the 1st getMarkup() call the producer responds with a Set-Cookie for with the session cookie (e.g. JSESSIONID or ASPSESSIONID).

Should this cookie (and session) be shared with any other portlets?

Thanks,

Nate

Nathan Lipke wrote:

499B2373.4070607@oracle.com" type="cite">When a producer sets cookies (in the HTTP Response headers) outside of an initCookie() call there is no guidance in the spec as to if and how these cookies should be returned to other portlets on the same producer. This should be specified.

My interpretation is:
It depends on the value of the CookieProtocol in the service description as follows:

• none - each portlet has its own cookies
• perUser - all portlets on a given producer share cookies
• perGroup - all portlets in a group share cookies.

Does this seem right? If so should it be added to errata?

Thanks,

Nate