302 Found response loses POST data

[APFCClyde]

I am working on a WAS site to search/display customer data. This site is located at a different IP from our main site. The customer logs in on the main site, then clicks a button which sends a POST request to the WAS site with their agentID. Unfortunately, if they have never been to the WAS site or have cleared their cache & cookies, the WAS responds thusly:

****************************************
12/06/2007 02:31:30 00 pm 14:31:30
192.168.0.30
POST / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-ms-application, application/vnd.ms-xpsdocument, application/xaml+xml, application/x-ms-xbap, application/x-shockwave-flash, application/x-silverlight, */*
Accept-Language: en-us
Content-Type: application/x-www-form-urlencoded
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.20706; .NET CLR 3.0.590)
Host: custinfo.apfcinc.com:81
Content-Length: 22
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: agentno=

[COLOR="Red"]agentID=z95&x=136&y=14[/COLOR]
****************************************
****************************************
12/06/2007 02:31:30 01 pm 14:31:30

R>>> HTTP/1.1 302 Found
R>>> Server: Alpha Five Application Server/8.0 1870-3132
R>>> Date: Thu, 06 Dec 2007 21:31:30 GMT
R>>> Content-Type: text/html
R>>> Content-Length: 144
R>>> Location: /?APFCCustInfo=9310e7c5d73c4bd899faefdef176bc7a
R>>> Accept-Ranges: none
R>>> Connection: close
R>>> Set-Cookie: APFCCustInfo=9310e7c5d73c4bd899faefdef176bc7a; expires=Sat, 05-Jan-2008 21:31:30 GMT; path=/
R>>>

The POST data is hilted in red. It then returns them to the login page on the main site since there is no POST data to process. They click the button again & this time the server responds:

12/06/2007 02:31:37 15 pm 14:31:37
192.168.0.30
POST / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-ms-application, application/vnd.ms-xpsdocument, application/xaml+xml, application/x-ms-xbap, application/x-shockwave-flash, application/x-silverlight, */*
Accept-Language: en-us
Content-Type: application/x-www-form-urlencoded
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.20706; .NET CLR 3.0.590)
Host: custinfo.apfcinc.com:81
Content-Length: 22
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: agentno=; APFCCustInfo=9310e7c5d73c4bd899faefdef176bc7a

[COLOR="Red"]agentID=z95&x=136&y=14[/COLOR]
****************************************
****************************************
12/06/2007 02:31:37 35 pm 14:31:37

R>>> HTTP/1.1 200 OK
R>>> Server: Alpha Five Application Server/8.0 1870-3132
R>>> Date: Thu, 06 Dec 2007 21:31:37 GMT
R>>> Content-Type: text/html
R>>> Content-Length: 11042
R>>> Accept-Ranges: none
R>>> Connection: close
R>>> Set-Cookie: APFCCustInfo=9310e7c5d73c4bd899faefdef176bc7a; expires=Sat, 05-Jan-2008 21:31:37 GMT; path=/
R>>> Set-Cookie: agentno=z95; path=/
R>>>

You'll notice the first response is 302 while the second is 200. The 200 works as I was expecting in the first place. I wanted to use POST to hide the page & data so that it couldn't be bookmarked since the login is on a different server than the WAS. If the cache is not cleared after the second POST, then the WAS always returns 200 & works properly.

Does anyone know how I can capture the POST data the first time or another method to get around this problem without forcing another logon procedure?

[Lenny Forziati]

Re: 302 Found response loses POST data

The problem is that the server always tries to assign a session id. If the browser does not already have a cookie with a unique session ID, the server sets a cookie with a unique session id and redirects the browser. Browsers will use a GET when the follow the redirect, so the POST body data will be lost.

To get around this, you can have your external site create a session ID and include it as part of the POST data. You will need to make sure that you always use a unique session ID.

If your Application Server is using the default session cookie name, you would send a post body such as

agentID=z95&x=136&y=14&a5w_sess_id=some_unique_value

[APFCClyde]

Re: 302 Found response loses POST data

Thx for the quick reply Lenny. I'll give that a try.