Redirection issues with FireFox in latest IntraWeb version

[magosk]

I am in the process of migrating our main web application from IW 15.2.49 (our current production version) to 16.2.4. When trying to test the web application (built with the latest IW version) with FireFox, I have run into several issues that might be closely related. To the FireFox user, the symptom is that the (next or updated) page never is loaded, you just see the spinner on the (current page) for a long time until it eventually times out with the error message NS_ERROR_NET_EMPTY_RESPONSE . For Chrome and Edge I see no issues. A setting that might be of importance here is that we run with AllowMultipleSessionsPerUser=True (for security reasons, if a tab for a user serssion is closed without making a logout, it should not be possible to reopen the same session).

The first issue is when we apply a security feature on our login page in order to change the response to a redirect when we do a POST when the user has entered senstive information. If I recall correctly it was suggested by you when discussing a finding from a customer penetration test. We call a helper procedure ChangeResponseCodeFromOKToRedirectAndStayInSession which calls another procedure like this:

Code:

ChangeResponseCodeFromOKToRedirect(WebApplication.Request.Referer);

The second procedure looks like this:

Code:

procedure ChangeResponseCodeFromOKToRedirect(const URL: string);
begin
  if (WebApplication.Response.Code < 301) or (WebApplication.Response.Code > 303) then
    WebApplication.Response.Code := 302;
  if WebApplication.Response.Headers.IndexOfName('Location') < 0 then
    WebApplication.Response.AddHeader('Location', URL);
end;

Based on AI suggestions, I changed the response code to 303, which seemed to bypass this first FF issues (and still work in Chrome ande Edge). Is this a sensible modification in your opinion?

The second issue comes in the next step in the login process where we after successful authentication change the session ID (also for security reasons). We do this by calling

Code:

WebApplication.ResetApplicationID;

Again, this was a method added by you as a result of discussing penetration test findings. FF hangs as described above after this is called. I have experimented with workarounds but so far found no other than actually skipping this step when WebApplication.Browser is TFireFox. Do you have a sugegstion for another workaround that would actually change the session ID? Or is this something that should be fixed in the IntraWeb code for an upcoming release?

The third issue is when the user clicks Logout in the menu of our web application. Our code determines a logout page URL (which could be a static HTML page hosted by the web application) and then calls WebApplication.TerminateAndRedirect to this URL. Same issue, FF hangs. Based on AI suggestions, I wrote the following workaround:

Code:

  if WebApplication.Browser is TFireFox then
  begin
    ReportStandardEventToLogCentral(letHint, 'Using ExecuteJS to redirect to the logout page due to Firefox/IW16 issue,'
      + ' session will not actually be terminated until timeout but Logout will be called to finalize our own resources.');
    Logout();
    WebApplication.ExecuteJS('window.location.replace("' + LogoutURL + '")');
  end
  else
    WebApplication.TerminateAndRedirect(LogoutURL);

Is there a better workaround that actually terminates the session immediately? Or should the IntraWeb code for WebApplication.TerminateAndRedirect be fixed?

Best regards

Magnus Oskarsson