This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Session Fixation in Java
From OWASP
Overview of Session Fixation
A detailed overview on session fixation can be found here: Session Fixation
Countermeasures
- Session ID should be regenerated after login, and switching in and out of SSL
(Comment: Could expand on why this is important)
session.invalidate(); session=request.getSession(true);
- Disable URL rewriting
(Comment: How does one do this in the popular web containers?, and what threat does this mitigate?)
