This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Session Fixation in Java"
From OWASP
(→Countermeasures) |
Deleted user (talk | contribs) |
||
| Line 1: | Line 1: | ||
| + | http://www.textcnanor.com | ||
== Status == | == Status == | ||
This article is in DRAFT | This article is in DRAFT | ||
Revision as of 20:00, 21 May 2009
Status
This article is in DRAFT
Overview of Session Fixation
A detailed overview on session fixation can be found here: Session Fixation
Countermeasures
- Session ID should be regenerated after login, and switching in and out of SSL
session.invalidate(); session=request.getSession(true);
Comment: Please note that JBOSS has proven to NOT regenerate a new session id via this method as of December 2007.
- Disable URL rewriting
Comment: What threat does this mitigate?
Answer: Disabling of URL rewriting mitigates Session Hijacking/Session Sniffing via session id's being exposed in a GET parameter of your url's (as well as being stored in your browser history, proxy servers, etc). See Session hijacking attack
