Vulnerability Code Sample (JAVA servlets) authentication is successful, the current session will not be invalid: public void doAction(HttpServletRequest request, HttpServletResponse response) { String pwd = requests

vulnerability code example (JAVA servlets)

authentication is successful, the current session will not be invalid:

public void doAction(HttpServlettml2Requestt request, HttpServletResponse response) {String pwd = request.getParameter("j_password");String usr = request.getParameter("j_username");SessionUser user = persistenceController.loginUser(usr, pwd);String msg = "";try {if (user != null) {// XXX session not invalidated!request.getSession().setAttribute(Constants.USER, user);msg = messageGenerator.RedirectMessage("/ok.html");} else {msg = messageGenerator.redirectMessage("/error.html");}PrintWriter out;out = response.getWriter();out.print(msg);out.flush();} catch (IOException e) {// ...}}

The solution is to invalidate the current session and then create a new session for the newly logged in user:

request.getSession().invalidate();request.getSession(true);

Another vulnerability code example

In this case, the session will not expire when logged out. cookie's value is cleared only in the user's browser:

@Overridepublic void doAction(HttpServletRequest request, HttpServletResponse response) {Cookie cookie = new Cookie("JSESSIONID","LOGOFF");response.addCookie(cookie);// XXX session not invalidated!response.sendRedirect("/");}

solution is to invalidate the session:

request.getSession().invalidate(); 

How to protect

For the problem of session fixed, call the invalidate method of HttpSession class after the user authentication is successful. Then create a new session by passing true to the getSession method of the HttpServletRequest class.

third-party frameworks may have integrated solutions for handling session management; be sure to understand how to invalidate sessions by reading the help documentation for third-party frameworks.

ensures that the session is invalidated by calling the invalidate method of the HttpSession class when logging out.