Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-5663

Default authentication behavior vulnerable to session fixation attacks

XMLWordPrintable

      See: https://www.owasp.org/index.php/Session_Fixation

      In JBossWeb, there was a system property to enable this behavior: org.apache.catalina.authenticator.AuthenticatorBase.CHANGE_SESSIONID_ON_AUTH

      Undertow does not seem to have an equivalent. I don't see any reason not to always force a session ID change following successful authentication when HttpSession.isNew() returns false.

              sdouglas1@redhat.com Stuart Douglas (Inactive)
              pferraro@redhat.com Paul Ferraro
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: