PM32007: POST-CHECK VALUE FOR SECURED RESOURCES CAN CAUSE REQUEST BY BROWSER FOR RESOURCE AFTER LOGOUT

APAR status

• Closed as program error.

Error description

• User Logs in receives landing page which references protected
  WCM Components such as image components that get cached on the
  browser using the Cache-Control Directives similar to the
  following
  Cache-Control: private,max-age=600,post-check=300,pre-check=600
  The user then logs out and logs in again somtimes several times
  at some point in time after the browsers cahced entry in the
  above case is older than 5 minutes a background request is sent
  to the server from the post-check retrieval task in IE.
  The next time the user logs in only the resource
  requested by the post-check retrieval task is displayed to the
  User
  
  CAUSE:
  The use of the post-check=300,pre-check=600 causes Microsoft IE
  to make a background request to refresh the cached time after
  the age of the cached item is older then the post-check value
  in
  this case 300 s or 5 minutes
  

Local fix

• Local Fix
  Apply PM25450 or PM28703 and use the white/black list filter to
  filter out the requests for specific WCM Resources that contain
  include the post-check and pre-check Cache-Control directives
  in
  the response header
  
  To enable this filtering feature you must add the following to
  the WP AuthenticationService Custom Properties in the WAS Admin
  Environment providers
  
  property to add if it does not exist
  login.explicit.filterchain
  
  
  Value: com.ibm.wps.auth.impl.ValidateRedirectLoginFilter
  
  If the above property already exists and contains a value
  pointing to a custom login filter add the
  :com.ibm.wps.auth.impl.ValidateRedirectLoginFilter
  to the end of the string the : is the login filter chain
  separator
  
  Add one of the following Custom Properties
  Property:
  filterchain.properties.com.ibm.wps.auth.impl
  .ValidateRedirectLog
  inFilter.whitelist.pattern
  
  
  Value: <regex matching protected resources that are to be
  allowed via a bookmark>
  eg to allow bookmarking of all myportal protected resoures us
  value of .*myportal.*
  
  or
  
  Property:
  filterchain.properties.com.ibm.wps.auth.impl
  .ValidateRedirectLog
  inFilter.blacklist.pattern
  
  Value: <regex matching protected resources that are not to be
  allowed via a bookmark>
  eg to not allow bookingmark of protected wcm content use a
  value
  of .*/myconnect/?.*
  

Problem summary

• User Logs in receives landing page which references protected
  WCM Components such as image components that get cached on the
  browser using the Cache-Control Directives similar to the
  following
  Cache-Control: private,max-age=600,post-check=300,pre-check=600
  The user then logs out and logs in again somtimes several times
  at some point in time after the browsers cahced entry in the
  above case is older than 5 minutes a background request is sent
  to the server from the post-check retrieval task in IE.
  The next time the user logs in only the resource
  requested by the post-check retrieval task is displayed to the
  User
  
  CAUSE:
  The use of the post-check=300,pre-check=600 causes Microsoft IE
  to make a background request to refresh the cached time after
  the age of the cached item is older then the post-check value
  in
  this case 300 s or 5 minutes
  

Problem conclusion

• WCM Changed to only include post-check if not private cache
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE PORTA

• Fixed component ID

  5724E7600

Applicable component levels

• R61C PSY

     UP

• R610 PSY

     UP

• R615 PSY

     UP