1

To ensure strict security at web application, we tried to mitigate cookie hijacking by adding code to weblogic.xml. Following is what we did:

Example that we had applied on weblogic.xml and faced session expiry issue.

  <param-name>CookieName</param-name>

  <param-value>I</param-value>

     </session-param>

        <cookie-secure >true</cookie-secure>

     <!--<cookie-http-only>true</cookie-http-only>-->

We implemented this line to ensure secure cookies:

<cookie-secure >true</cookie-secure>

However due to this, we are facing session expiry and I was looking for any alternate solution to come-by keeping cookies secure - is there any alternate solution for the secure cookie?

EDIT: We're using these below versions and other details. The initial answers provided did not support the documentation here. 

Server info: WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008 1137967
Servlet version: 2.5
JSP version: 2.1
Java version: 1.6.0_05
Server

I needed a solution around this configuration.

Improve this question
4
  • 1
    Set a longer timeout - docs.oracle.com/cd/E13222_01/wls/docs103/webapp/…
    – Neil Smithline
    Nov 7 '15 at 17:36
  • This is not supported in the version we had been using, see edited content.
    – Shritam Bhowmick
    Nov 10 '15 at 7:30
  • I don't know if it's possible. One thought I have is whether Oracle is still supporting that version of WLS. If not, there are likely known vulnerabilities in it. Very bad.
    – Neil Smithline
    Nov 10 '15 at 16:28
  • are there any work-arounds? since, it's huge code dependent on it and we need to mitigate just cookie hijacking issue.
    – Shritam Bhowmick
    Nov 10 '15 at 18:18
1

I am not sure if I completely understood the issue, but here are my suggestions:

If the HTTPOnly Cookie flag is set then:

 {
 <session-config>
 <cookie-config>
 <http-only>true</http-only>
 </cookie-config>
 </session-config>
 }

If the session ID is transmitted in an URL parameter, try to dump it and see if there is there any counter running on it:

 {
 <session-config>
 <tracking-mode>COOKIE</tracking-mode>
 </session-config>
 }

Next, try to increase the expiration time and then try to migrate it securely. If it is not configured well you might be able to:

Increase the expiration time:

 {
 <session-config>
 <session-timeout>Time Period(In minutes)</session-timeout>
 </session-config>
 }

Please notify me if I understood the question incorrectly.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.