Is JSessionID considered for Session Variable Overloading (also known as Session Puzzling)?

  1. A java web application is deployed in HTTPS
  2. An admin user logs to the application. After login, a new JSessionID is issued.
  3. Another non-admin user manages to get that admin user JsessionID
  4. Using that Jsession Id the non-admin user performs some admin function.

Can it be considered as session puzzling?


1 Answer 1


Thank you. It is actually session hijacking. So anyone having admin user JSessionID can impersonate and perform admin function. To mitigate the session hijacking issue following measures can be taken

  1. Have XSS validation in place for your application
  2. change your JSessionID after login ie avoid session fixation
  3. Provide strict transport layer security ie deploy your application in HTTPS (SSL/TLS)
  4. The seesion time out should b reduced as much as possible
  5. The cookies should be set to HTTPONLY and secure. OWASP Recommendation

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .