Added comments about not performing request validation on error pages.

Author: frwiqueueit

QueueIT.Security.Examples/web/error.jsp

@@ -3,7 +3,10 @@
 <%@page contentType="text/html" pageEncoding="UTF-8"%>
 <%@taglib prefix="t" tagdir="/WEB-INF/tags" %>
 <%
-    String queueName = request.getParameter("queuename");
+    // IMPORTANT !
+	// Never call request validation from error handling pages (e.g. error.jsp) which will cause users to get looped arround.
+	
+	String queueName = request.getParameter("queuename");
     URI targetUrl = new URI(request.getParameter("t"));
     IQueue queue = QueueFactory.createQueue(queueName);
     String cancelUrl = queue.getCancelUrl(targetUrl).toString();

QueueIT.Security/src/queueit/security/SessionValidationController.java

@@ -9,7 +9,12 @@
 
 public class SessionValidationController {
 
-    private static int defaultTicketExpiration = 0;
+    
+	// IMPORTANT !
+	// Never call request validation from error handling pages (e.g. error.jsp) which will cause users to get looped arround.
+	
+
+	private static int defaultTicketExpiration = 0;
     private static IValidateResultRepository defaultValidationResultRepository = new CookieValidateResultRepository();
     private static Callable<IValidateResultRepository> defaultValidationResultProviderFactory = new Callable<IValidateResultRepository>() {
         public IValidateResultRepository call() {