I have a question about "session-theft" and the supporting of "deep links" in a web application, and best practice.
Our web application has a small number of front-door public web pages (e.g.
/servlet/Login) and the rest of the application is considered to be private pages that can only be accessed by authenticated users. The login process results in a session being created with a random id, and then the system ensures that all links generated by the system embed this ID. So for instance, the home page which is really
/servlet/Home is rendered as
/servlet/@SESSION_ID@/Home. The framework checks the
@SESSION_ID@ in the URL and if it doesn't exist (or doesn't match the user's session in the memory on the server) then the user gets redirected to the login page with an error, since clearly this request originated from outside the system and/or from a different session.
This technique has been in use for several years, and apart from being really annoying (you cannot bookmark anything) the idea appears to be that nobody can trick you into clicking on a link in the application that can take advantage of an authenticated session in another tab - i.e. the person crafting the link wouldn't know what the session id is, and thus can only trick you into navigating to one of the public links.
We need to be able to support "deep links" in the application now; such that a user in one application can invoke our application with a URL such as
/servlet/WorkOrderDisplay?id=1234. The required behaviour is that if the user has not already logged in to our application, then they should be redirected to the login screen and after a successful login taken to the work order. However, subsequently clicking on that URL (whilst the session is active) should not send them to the login screen. Herein lies the problem - the other application doesn't (and can't) know the session id to use, so the request will always be considered an untrusted one. We could create a whitelist of trusted URLs, but I don't feel qualified enough to know if this is just creating a backdoor to circumvent the protection.
My real question though is why I don't see this technique used on other websites. How do other websites protect against this "session theft", and does our home-grown technique really enhance security? I should add that our application is akin to a CRM system rather than a Banking/Finance system - we need to balance security with usability so we cannot force every click from outside the system to go to the login screen.
Advice, links to other articles etc would be greatly appreciated.
Apologies if I've used the wrong terminology here. I've tried to Google a lot, but suspect I'm not using the right terminology, although my Googling did lead me to find https://cheatsheetseries.owasp.org/