Pfthb

Google Chrome is making this request on the login page.

Request URL: http://app.country-region-9.elasticbeanstalk.com/admin/login
Request Method: POST
Status Code: 302 Found
Remote Address: 99.99.99.99:80
Referrer Policy: no-referrer-when-downgrade

Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: keep-alive
Content-Language: en-US
Content-Length: 0
Date: Thu, 15 Nov 2018 04:23:19 GMT
Expires: 0
Location: /home;jsessionid=15884DA40ECAD4F5CBA6CD138B4B4105
Pragma: no-cache
Server: nginx/1.12.1
Set-Cookie: JSESSIONID=15884DA40ECAD4F5CBA6CD138B4B4105; Path=/; HttpOnly

I have this setting already in application.properties.

server.session.tracking-modes=cookie

So why is Spring Boot appending ;jsessionid to the redirect location? It is breaking the app because Spring Security complains about the semicolon. It works in my local machine and doesn't append the session. It is only failing when deployed to AWS.

This is the action in the controller which redirects:

 @RequestMapping(value = "/admin/login", method = RequestMethod.POST)
 public String doLogin(HttpServletRequest request, HttpServletResponse response) {
...
 request.getSession().setAttribute("user", user);
 return "redirect:/home";

I also confirmed it with curl

$ curl -i http://app.country-region-9.elasticbeanstalk.com/admin/login -d username=xxxx -d password=xxxxxxxxxxx 
HTTP/1.1 302 Found 
...
Location: /home;jsessionid=5A1009B5F3C59ED0F794E625B5E36EA0 

But it's not doing that locally.

$ curl -i http://localhost:8080/admin/login -d username=xxxxx -d password=xxxxxxxxxx
HTTP/1.1 302
Set-Cookie: JSESSIONID=4B8930CCC8CE85167089CEBEB47657D4; Path=/; HttpOnly
...
Location: http://localhost:8080/home