Session Fixation in Java

From OWASP
Revision as of 14:44, 5 March 2007 by Rohyt (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Overview of Session Fixation

A detailed overview on session fixation can be found here: Session Fixation

Countermeasures

  • Session ID should be regenerated after login, and switching in and out of SSL
 session.invalidate();
 session=request.getSession(true);
  • Disable URL rewriting