This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Session Fixation in Java
From OWASP
Revision as of 19:44, 5 March 2007 by Rohyt (talk | contribs) (New page: ==Overview of Session Fixation== A detailed overview on session fixation can be found here: Session Fixation ==Countermeasures== * Session ID should be regenerated after login, and ...)
Overview of Session Fixation
A detailed overview on session fixation can be found here: Session Fixation
Countermeasures
- Session ID should be regenerated after login, and switching in and out of SSL
session.invalidate(); session=request.getSession(true);
- Disable URL rewriting
