Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: neutral (nike.apache.org: local policy)
Message-ID: <47B0B0EF.5060905@christopherschultz.net>
Date: Mon, 11 Feb 2008 15:32:47 -0500
From: Christopher Schultz <chris@christopherschultz.net>
User-Agent: Thunderbird 2.0.0.9 (Windows/20071031)
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: How to avoid session fixation?
References: <a475e7310802060511h66215390m720f37dee31ad9e7@mail.gmail.com>
	 <47AA15AC.2080502@christopherschultz.net>
 <47AA2B3C.9040103@oma.be>	 <47AA3A41.90404@christopherschultz.net>
 <a475e7310802080149k10079138k4060864c1c82b21a@mail.gmail.com>
 <47AC28D6.3010702@oma.be>
In-Reply-To: <47AC28D6.3010702@oma.be>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

David,

David Delbecq wrote:
| I think this is worth submitting a security issue request on tracker,
| to ask that, at least, the container links the requester IP to the
| session.

I'm pretty sure that nobody will want to do this -- at least not without
the ability to turn the feature off. You'll break a lot of users if you
require session id <-> ip address matching.

| Changing session ID upon login in container would be a good thing
| imho, it would ensure ID become unknown to attacker after login,
| wouldn't destroy user session (keep session, only change it's
| identifier) and would work whatever authentication mechanism is used.
|
I completely agree. Christopher, I think your valve might be more
attractive if it was able to change the id of the session and leave it
at that. I'm not familiar enough with the Tomcat API to know if this is
possible and/or a good idea.

| Draw back is that webapp that rely on session id for some session
| tracking mechanism would break.

True, although most webapps probably use whatever session id is
currently in use. If you did a lot of AJAX where the session id
available to the page becomes out-of-date after a login, you will have
to make special considerations for that. I think you'll find that this
is not much of a problem.

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkewsO8ACgkQ9CaO5/Lv0PBWXQCggsMZA1AGkdzSDvBmYeHC2JED
iU4An15g6IGrG/yU4mgWokKnVkXdnW0O
=eLbx
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org