1

To ensure strict security at web application, we tried to mitigate cookie hijacking by adding code to weblogic.xml. Following is what we did:

Example that we had applied on weblogic.xml and faced session expiry issue.

  <param-name>CookieName</param-name>

  <param-value>I</param-value>

     </session-param>

        <cookie-secure >true</cookie-secure>

     <!--<cookie-http-only>true</cookie-http-only>-->

We implemented this line to ensure secure cookies:

<cookie-secure >true</cookie-secure>

However due to this, we are facing session expiry and I was looking for any alternate solution to come-by keeping cookies secure - is there any alternate solution for the secure cookie?

EDIT: We're using these below versions and other details. The initial answers provided did not support the documentation here. 

Server info: WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008 1137967
Servlet version: 2.5
JSP version: 2.1
Java version: 1.6.0_05
Server

I needed a solution around this configuration.

|improve this question

closed as unclear what you're asking by SilverlightFox, Xander, WhiteWinterWolf, Stephane, M'vy Nov 13 '15 at 14:06

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Set a longer timeout - docs.oracle.com/cd/E13222_01/wls/docs103/webapp/… – Neil Smithline Nov 7 '15 at 17:36
  • This is not supported in the version we had been using, see edited content. – Shritam Bhowmick Nov 10 '15 at 7:30
  • I don't know if it's possible. One thought I have is whether Oracle is still supporting that version of WLS. If not, there are likely known vulnerabilities in it. Very bad. – Neil Smithline Nov 10 '15 at 16:28
  • are there any work-arounds? since, it's huge code dependent on it and we need to mitigate just cookie hijacking issue. – Shritam Bhowmick Nov 10 '15 at 18:18
1

I am not sure if I completely understood the issue, but here are my suggestions:

If the HTTPOnly Cookie flag is set then:

 {
 <session-config>
 <cookie-config>
 <http-only>true</http-only>
 </cookie-config>
 </session-config>
 }

If the session ID is transmitted in an URL parameter, try to dump it and see if there is there any counter running on it:

 {
 <session-config>
 <tracking-mode>COOKIE</tracking-mode>
 </session-config>
 }

Next, try to increase the expiration time and then try to migrate it securely. If it is not configured well you might be able to:

Increase the expiration time:

 {
 <session-config>
 <session-timeout>Time Period(In minutes)</session-timeout>
 </session-config>
 }

Please notify me if I understood the question incorrectly.

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.