vulnerability code example (JAVA servlets)
authentication is successful, the current session will not be invalid:
public void doAction(HttpServlettml2Requestt request, HttpServletResponse response) {String pwd = request.getParameter("j_password");String usr = request.getParameter("j_username");SessionUser user = persistenceController.loginUser(usr, pwd);String msg = "";try {if (user != null) {// XXX session not invalidated!request.getSession().setAttribute(Constants.USER, user);msg = messageGenerator.RedirectMessage("/ok.html");} else {msg = messageGenerator.redirectMessage("/error.html");}PrintWriter out;out = response.getWriter();out.print(msg);out.flush();} catch (IOException e) {// ...}}The solution is to invalidate the current session and then create a new session for the newly logged in user:
request.getSession().invalidate();request.getSession(true);Another vulnerability code example
In this case, the session will not expire when logged out. cookie's value is cleared only in the user's browser:
@Overridepublic void doAction(HttpServletRequest request, HttpServletResponse response) {Cookie cookie = new Cookie("JSESSIONID","LOGOFF");response.addCookie(cookie);// XXX session not invalidated!response.sendRedirect("/");}solution is to invalidate the session:
request.getSession().invalidate(); How to protect
For the problem of session fixed, call the invalidate method of HttpSession class after the user authentication is successful. Then create a new session by passing true to the getSession method of the HttpServletRequest class.
third-party frameworks may have integrated solutions for handling session management; be sure to understand how to invalidate sessions by reading the help documentation for third-party frameworks.
ensures that the session is invalidated by calling the invalidate method of the HttpSession class when logging out.
