TomcatExpert

Session Fixation Protection

posted by mthomas on April 25, 2011 06:30 AM

A common practice these days in email marketing is to provide users with custom links that direct them quickly to their own account, and streamline the number of steps needed to sign up for additional services or address outdated or invalid account information. This is great for company relationships with their customers, however it is somewhat easily exploited.

A simple scenario

Mary and Bob both have accounts with the same bank. Mary is not very internet savvy, and Bob is. Bob sends Mary a link that is plainly seen to be their bank’s address and attaches a session ID (http://www.foobank.com/?SID=BOB_KNOWS_THE_ID). Mary sees its one of the bank’s URLs, and clicks it, logs in with her username and password. As soon as she does that, Bob is able to also click that link and the session is now validated so he has full access to all her account information and money!

There are more complex scenarios documented across the web. Some additional easy to understand examples can be found on Wikipedia. Reality is that there are several things Mary could do to be more educated and protect herself, but consumers are hard to educate perfectly. In turn, companies—especially ones that rely on authenticated sessions to service their customers—must protect their customers from these types of attacks.

Session Fixation Protection

A new security feature for Apache Tomcat 7 is Session Fixation Protection. Essentially, when a user authenticates their session, Tomcat will change the session ID. It does not destroy the previous session, rather it renames it so it is no longer found by that ID. So in our example above, Bob would try and log on with that session, and he would not be able to find it.

Turning off Session Fixation Protection

Session fixation protection is turned on by default in all Apache Tomcat 7 versions and from Apache Tomcat 6.0.21 on. If you do not wish to use this protection, you need to modify the configuration of the internal valve in Tomcat that does the authentication.

Normally you do not see this valve in a server.xml or context.xml file. As soon as you configure a web application with authentication, whether its basic, form, digest or client cert, Tomcat will automatically insert the appropriate authentication valve into your configuration. To turn it off, rather than relying on Tomcat’s implicit configuration, you will need to add it explicitly.

So, if you were using basic authentication, you would need to navigate to the context.xml file for your application (not $CATALINA_BASE/conf/context.xml - that is the global context.xml that provides defaults for all web applications) and add a valve using className="org.apache.catalina.authenticator.BasicAuthenticator" and also set the parameter changeSessionIdOnAuthentication="false".  For more information on the various valves and classes needed, please see the Apache Tomcat Valve Configuration documentation.

When to Disable Session Fixation

The ASF Security Team deemed this a basic enough protection to make it by default turned on in Tomcat 7. Turning it off is not generally advised, unless it is breaking your application functionality in some way. Generally, it is advised to leave this protection on as an added precaution for valuable customer information.

Mark Thomas is a Senior Software Engineer for the SpringSource Division of VMware, Inc. (NYSE: VMW). Mark has been using and developing Tomcat for over six years. He first got involved in the development of Tomcat when he needed better control over the SSL configuration than was available at the time. After fixing that first bug, he started working his way through the remaining Tomcat bugs and is still going. Along the way Mark has become a Tomcat committer and PMC member, volunteered to be the Tomcat 4 & 7 release manager, created the Tomcat security pages, become a member of the ASF and joined the Apache Security Committee. He also helps maintain the ASF's Bugzilla instances. Mark has a MEng in Electronic and Electrical Engineering from the University of Birmingham, United Kingdom.

Comments

class should be className

I believe it should be className instead of class in the attribute described above for a valve.

Correct. I'll get that

Correct. I'll get that changed.

to download software mxf

to download software mxf converter, convert p2 mxf files from your camcorder. convert mxf files to avi mp4 mov v34

Really nice and interesting

Really nice and interesting post. I was looking for this kind of information and enjoyed reading this one. Keep posting. Thanks for sharing. BA Course Houston

Glad to chat your blog, I

Glad to chat your blog, I seem to be forward to more reliable articles and I think we all wish to thank so many good articles, blog to share with us. bakers houston

Cool you inscribe, the info

Cool you inscribe, the info is really salubrious further fascinating, I'll give you a connect to my scene. Computer Store Orlando

You actually make it look so

You actually make it look so easy with your performance but I find this matter to be actually something which I think I would never comprehend. It seems too complicated and extremely broad for me. I'm looking forward for your next post, I’ll try to get the hang of it! subway surfers games

Took me time to read all the

Took me time to read all the comments, but I really enjoyed the article. It proved to be Very helpful to me and I am sure to all the commenters here! It’s always nice when you can not only be informed, but also entertained! hampton bay fan

Your texts on this subject

Your texts on this subject are correct, see how I wrote this site is really very good. annuaire Generateurcodepsn

I've proper selected to build

I've proper selected to build a blog, which I hold been deficient to do for a during. Acknowledges for this inform, it's really serviceable! stratégie seo

wow this saintly however ,I

wow this saintly however ,I love your enter plus nice pics might be part personss negative love being defrent mind total poeple , locksmith hallandale

It has fully emerged to crown

It has fully emerged to crown Singapore's southern shores and undoubtedly placed her on the global map of residential landmarks. I still scored the more points than I ever have in a season for GS. I think you would be hard pressed to find somebody with the same consistency I have had over the years so I am happy with that. red smoothie detox factor

nice post

The rapid growth of online shopping for the LED lighting industry sales channels provide a new possibility. Therefore, exploring the road of LED lighting industry, e-commerce is very important. stadium lights

I've proper selected to build

I've proper selected to build a blog, which I hold been deficient to do for a during. Acknowledges for this inform, it's really serviceable! travel umroh terpercaya

Glad to chat your blog, I

Glad to chat your blog, I seem to be forward to more reliable articles and I think we all wish to thank so many good articles, blog to share with us. I will really appreciate the writer's choice for choosing this excellent article appropriate to my matter.Here is deep description about the article matter which helped me more. medical supplies store

Very nice blog and articles.

Very nice blog and articles. I am realy very happy to visit your blog. Now I am found which I actually want. I check your blog everyday and try to learn something from your blog. Thank you and waiting for your new post. Triple threat weight loss

It’s very informative and you

It’s very informative and you are obviously very knowledgeable in this area. You have opened my eyes to varying views on this topic with interesting and solid content. Metabolic Cooking PDF

Hi! This is my first visit to

Hi! This is my first visit to your blog! We are a team of volunteers and new initiatives in the same niche. Blog gave us useful information to work. You have done an amazing job! travel umroh terpercaya

asid

Cheers pertaining to delivering the latest changes in connection with worry, My spouse and i expect go through additional. Apps Development Saudi Arabia

sl786982

wow, great, I was wondering

wow, great, I was wondering how to cure acne naturally. and found your site by google, learned a lot, now i’m a bit clear. I’ve bookmark your site and also add rss. keep us updated. plug and play digital signage

I just got to this amazing

I just got to this amazing site not long ago. I was actually captured with the piece of resources you have got here. Big thumbs up for making such wonderful blog page! make money online

I would like to thank you for

I would like to thank you for the efforts you have made in writing this article. I am hoping the same best work from you in the future as well. In fact your creative writing abilities has inspired me to start my own Blog Engine blog now. Really the blogging is spreading its wings rapidly. Your write up is a fine example of it. Pulau Perhentian Pakej 2016

I recently came across your

I recently came across your article and have been reading along. I want to express my admiration of your writing skill and ability to make readers read from the beginning to the end. I would like to read newer posts and to share my thoughts with you. servicio tecnico moviles en tarragona

I really enjoy simply reading

I really enjoy simply reading all of your weblogs. Simply wanted to inform you that you have people like me who appreciate your work. Definitely a great post. Hats off to you! The information that you have provided is very helpful. teacup pig reviews

I am a new user of this site

I am a new user of this site so here i saw multiple articles and posts posted by this site,I curious more interest in some of them hope you will give more information on this topics in your next articles. Garage Door Replacement Sunrise manor

Hi! This is my first visit to

Hi! This is my first visit to your blog! We are a team of volunteers and new initiatives in the same niche. Blog gave us useful information to work. You have done an amazing job! Karachi Chat Room

do my paper

Once you are certain that you want to hire a service, you have to ensure that it will give you everything which you need.do my paper

BlackMen

configuration of the internal valve in Tomcat that does the authentication.cccam server

Your blogs further more each

Your blogs further more each else volume is so entertaining further serviceable It appoints me befall retreat encore. I will instantly grab your rss feed to stay informed of any updates. meta

Sl786982

Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts. Any way I'll be subscribing to your feed and I hope you post again soon. Big thanks for the useful info. jesse cannone

sl786982

car dash cams

If the worst happens and you are involved in an accident , dash cameras are a gret way of proving responsibility.car dash cams

sl786982

would you mind updating your blog with more information? It is extremely helpful for me. pregnancy miracle

sl786982

3 week diet review

Nice to be visiting your blog again, it has been months for me. Well this article that i've been waited for so long. I need this article to complete my assignment in the college, and it has same topic with your article. Thanks, great share.3 week diet review

I can advice you a few

I can advice you a few websites Your best trainer for your legs
Add 2 eggs to mix it
The best tool to make better makeup easier
Dehydrators from USA
Однако лучший скорее всего сайт, который мог бы Вас заинтересовать лучше остальных это вебсайт посвящен знакам зодаиака, узнай свой знак зодиака уже сегодня

Marketing has many different

Marketing has many different and latest trends going to happen in this world. People take coursework writing service to check out suitable and safest ways to do it.

dowry harassment punishment

I have been researching every aspect of a possible career move. This post is very helpful and shows that you have a lot of knowledge on the topic. Do you have any others?

dowry harassment punishment

Regular visits listed here

Regular visits listed here are the easiest method to appreciate your energy, which is why why I am going to the website everyday, searching for new, interesting info. Many, thank you! young female entrepreneurs

I am looking for and I love

I am looking for and I love to post a comment that "The content of your post is awesome" Great work! after school club primary school

I definitely enjoying every

I definitely enjoying every little bit of it and I have you bookmarked to check out new stuff you post. vintage stores

I have express a few of the

I have express a few of the articles on your website now, and I really like your style of blogging. I added it to my favorite’s blog site list and will be checking back soon…chalk vinyl

I am overwhelmed by your post

I am overwhelmed by your post with such a nice topic. Usually I visit your blogs and get updated through the information you include but today’s blog would be the most appreciable. Well done! festival essentials

This post is really

This post is really magnificent. I really like this post. It is one of the best posts that I ve read in a long time. Thanks a lot for this really good post. I really appreciate it! clases de ingles con nativos

With so many books and

With so many books and articles coming up to give gateway to make-money-online field and confusing reader even more on the actual way of earning money, Hubwit is a refreshing change. I stumbled upon this site while searching for work-form-home options. phim sex online

asid

Thanks. I really enjoyed the quality information you offer to your visitors for this blog. I will bookmark your blog and have my friends check up here often. Mac Repair

sl786982

It should be noted that

It should be noted that whilst ordering papers for sale at paper writing service, you can get unkind attitude. In case you feel that the bureau is trying to cheat you, don't buy term paper from it. manifest abundance

Sl786982

I agree with your Blog and I will be back to inspect it more in the future so please keep up your act. bikini

sl786982

Consultant SEO Marseille

Hi there, I discovered your blog per Google bit searching for such kinda educational advise moreover your inform beholds very remarkable for me.
consultant seo

amir

I favor your current article. It can be very good to view anyone explain in words through the cardiovascular along with lucidity for this critical issue might be quickly seen. details watch internet site.
Trade Forecast Review

Pretty remarkable post. I

Pretty remarkable post. I simply came across your blog and desired to say that I have really enjoyed searching your blog posts.essex freelance hairdressers

Muneer

I can see why since you have done such a good job of making it interesting.http://prokr.com/blog/

Post new comment

CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.