0

We modified our Session handling from cookie based to URL Rewriting. By doing this the session id gets transmitted as part of the URL.

Now there is a vulnerability issue, where whoever uses this URL will be able to log in into the system.

To resolve this issue we have done the following

  1. A HTTP Session Listener has been created to maintain list of HTTP sessions. Listener reacts on the events when session are created or destroyed.

  2. A Session Filter has been created to verify HTTP Session and check its integrity against HTTP Request attributes Session will be invalidated in case Request attributes (identifying the client origin) do not match original attributes stored with session. (to block the session hijack attempt)

However i think that this has a gap, when you are trying to access over a proxy etc.

Is there any other effective solution for this?

Also we cannot use third party libraries to resolve this because of the nature of the produce.

Improve this question

1 Answer 1

Reset to default
3

Sensitive information should never be transmitted using GET requests. The main reason is that users sometimes send links to eachother. Your system will probably fail to detect it when clients are behind a NAT router or a proxy.

If you are using sessions you might as well restart using cookies. I'm not really sure why you would need to put the session in the URL.

Improve this answer
3
  • We wanted multiple logins to be allowed with different username/pwd. With cookies this is not possible.
    – Karthik K N
    Commented Jul 9, 2014 at 8:18
  • 3
    You can actually do this, for instance Gmail/Google allows this as well. Maybe you should rethink your whole application as you are solving an issue which might not need to be there in the first place (what's the reason people need to log on with multiple usernames?). Your fix generates more security problems within your authentication and authorization process than it actually solves
    – Lucas Kauffman
    Commented Jul 9, 2014 at 13:38
  • @KarthikKN it's actually very simple to support multiple session with cookies. A simple way would be to allow multiple cookies with the same name, for multiple logins. When a user connects, and multiple active sessions are detected, the system can allow the user to select a specific session to use. The choice can be stored encoded in the URL, for example. See Spring Session for an open source implementation.
    – Boris the Spider
    Commented Jan 31, 2016 at 23:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .