Tag Info

New answers tagged


The servlet engine you are using securely handles session cookies when you call request.getSession(), and is not vulnerable to fixation. (as discussed in the comments) This behavior is both intentional and correct. Whether getSession(), getSession(true) or getSession(false) is called, the server relies on its own memory to determine if there is a valid ...


In the case of CRIME, the attack is on the client. Hostile Javascript in the client triggers requests to the server, that the attacker observes from the outside; and (that's the important point here) the attacker can block the outgoing request. The attacker needs to see the encrypted records, but not necessarily to let them go all the way to the server. ...

Top 50 recent answers are included