TomcatExpert

Session Fixation Protection

posted by mthomas on April 25, 2011 06:30 AM

A common practice these days in email marketing is to provide users with custom links that direct them quickly to their own account, and streamline the number of steps needed to sign up for additional services or address outdated or invalid account information. This is great for company relationships with their customers, however it is somewhat easily exploited.

A simple scenario

Mary and Bob both have accounts with the same bank. Mary is not very internet savvy, and Bob is. Bob sends Mary a link that is plainly seen to be their bank’s address and attaches a session ID (http://www.foobank.com/?SID=BOB_KNOWS_THE_ID). Mary sees its one of the bank’s URLs, and clicks it, logs in with her username and password. As soon as she does that, Bob is able to also click that link and the session is now validated so he has full access to all her account information and money!

There are more complex scenarios documented across the web. Some additional easy to understand examples can be found on Wikipedia. Reality is that there are several things Mary could do to be more educated and protect herself, but consumers are hard to educate perfectly. In turn, companies—especially ones that rely on authenticated sessions to service their customers—must protect their customers from these types of attacks.

Session Fixation Protection

A new security feature for Apache Tomcat 7 is Session Fixation Protection. Essentially, when a user authenticates their session, Tomcat will change the session ID. It does not destroy the previous session, rather it renames it so it is no longer found by that ID. So in our example above, Bob would try and log on with that session, and he would not be able to find it.

Turning off Session Fixation Protection

Session fixation protection is turned on by default in all Apache Tomcat 7 versions and from Apache Tomcat 6.0.21 on. If you do not wish to use this protection, you need to modify the configuration of the internal valve in Tomcat that does the authentication.

Normally you do not see this valve in a server.xml or context.xml file. As soon as you configure a web application with authentication, whether its basic, form, digest or client cert, Tomcat will automatically insert the appropriate authentication valve into your configuration. To turn it off, rather than relying on Tomcat’s implicit configuration, you will need to add it explicitly.

So, if you were using basic authentication, you would need to navigate to the context.xml file for your application (not $CATALINA_BASE/conf/context.xml - that is the global context.xml that provides defaults for all web applications) and add a valve using className="org.apache.catalina.authenticator.BasicAuthenticator" and also set the parameter changeSessionIdOnAuthentication="false".  For more information on the various valves and classes needed, please see the Apache Tomcat Valve Configuration documentation.

When to Disable Session Fixation

The ASF Security Team deemed this a basic enough protection to make it by default turned on in Tomcat 7. Turning it off is not generally advised, unless it is breaking your application functionality in some way. Generally, it is advised to leave this protection on as an added precaution for valuable customer information.

Mark Thomas is a Senior Software Engineer for the SpringSource Division of VMware, Inc. (NYSE: VMW). Mark has been using and developing Tomcat for over six years. He first got involved in the development of Tomcat when he needed better control over the SSL configuration than was available at the time. After fixing that first bug, he started working his way through the remaining Tomcat bugs and is still going. Along the way Mark has become a Tomcat committer and PMC member, volunteered to be the Tomcat 4 & 7 release manager, created the Tomcat security pages, become a member of the ASF and joined the Apache Security Committee. He also helps maintain the ASF's Bugzilla instances. Mark has a MEng in Electronic and Electrical Engineering from the University of Birmingham, United Kingdom.

Comments

class should be className

I believe it should be className instead of class in the attribute described above for a valve.

Correct. I'll get that

Correct. I'll get that changed.

to download software mxf

to download software mxf converter, convert p2 mxf files from your camcorder. convert mxf files to avi mp4 mov v34

Really nice and interesting

Really nice and interesting post. I was looking for this kind of information and enjoyed reading this one. Keep posting. Thanks for sharing. BA Course Houston

Glad to chat your blog, I

Glad to chat your blog, I seem to be forward to more reliable articles and I think we all wish to thank so many good articles, blog to share with us. bakers houston

Cool you inscribe, the info

Cool you inscribe, the info is really salubrious further fascinating, I'll give you a connect to my scene. Computer Store Orlando

You actually make it look so

You actually make it look so easy with your performance but I find this matter to be actually something which I think I would never comprehend. It seems too complicated and extremely broad for me. I'm looking forward for your next post, I’ll try to get the hang of it! subway surfers games

Took me time to read all the

Took me time to read all the comments, but I really enjoyed the article. It proved to be Very helpful to me and I am sure to all the commenters here! It’s always nice when you can not only be informed, but also entertained! hampton bay fan

Your texts on this subject

Your texts on this subject are correct, see how I wrote this site is really very good. annuaire Generateurcodepsn

I've proper selected to build

I've proper selected to build a blog, which I hold been deficient to do for a during. Acknowledges for this inform, it's really serviceable! stratégie seo

wow this saintly however ,I

wow this saintly however ,I love your enter plus nice pics might be part personss negative love being defrent mind total poeple , locksmith hallandale

It has fully emerged to crown

It has fully emerged to crown Singapore's southern shores and undoubtedly placed her on the global map of residential landmarks. I still scored the more points than I ever have in a season for GS. I think you would be hard pressed to find somebody with the same consistency I have had over the years so I am happy with that. red smoothie detox factor

nice post

The rapid growth of online shopping for the LED lighting industry sales channels provide a new possibility. Therefore, exploring the road of LED lighting industry, e-commerce is very important. stadium lights

I've proper selected to build

I've proper selected to build a blog, which I hold been deficient to do for a during. Acknowledges for this inform, it's really serviceable! travel umroh terpercaya

Glad to chat your blog, I

Glad to chat your blog, I seem to be forward to more reliable articles and I think we all wish to thank so many good articles, blog to share with us. I will really appreciate the writer's choice for choosing this excellent article appropriate to my matter.Here is deep description about the article matter which helped me more. medical supplies store

Very nice blog and articles.

Very nice blog and articles. I am realy very happy to visit your blog. Now I am found which I actually want. I check your blog everyday and try to learn something from your blog. Thank you and waiting for your new post. Triple threat weight loss

It’s very informative and you

It’s very informative and you are obviously very knowledgeable in this area. You have opened my eyes to varying views on this topic with interesting and solid content. Metabolic Cooking PDF

Hi! This is my first visit to

Hi! This is my first visit to your blog! We are a team of volunteers and new initiatives in the same niche. Blog gave us useful information to work. You have done an amazing job! travel umroh terpercaya

asid

Cheers pertaining to delivering the latest changes in connection with worry, My spouse and i expect go through additional. Apps Development Saudi Arabia

sl786982

wow, great, I was wondering

wow, great, I was wondering how to cure acne naturally. and found your site by google, learned a lot, now i’m a bit clear. I’ve bookmark your site and also add rss. keep us updated. plug and play digital signage

I just got to this amazing

I just got to this amazing site not long ago. I was actually captured with the piece of resources you have got here. Big thumbs up for making such wonderful blog page! make money online

I would like to thank you for

I would like to thank you for the efforts you have made in writing this article. I am hoping the same best work from you in the future as well. In fact your creative writing abilities has inspired me to start my own Blog Engine blog now. Really the blogging is spreading its wings rapidly. Your write up is a fine example of it. Pulau Perhentian Pakej 2016

I recently came across your

I recently came across your article and have been reading along. I want to express my admiration of your writing skill and ability to make readers read from the beginning to the end. I would like to read newer posts and to share my thoughts with you. servicio tecnico moviles en tarragona

I really enjoy simply reading

I really enjoy simply reading all of your weblogs. Simply wanted to inform you that you have people like me who appreciate your work. Definitely a great post. Hats off to you! The information that you have provided is very helpful. teacup pig reviews

I am a new user of this site

I am a new user of this site so here i saw multiple articles and posts posted by this site,I curious more interest in some of them hope you will give more information on this topics in your next articles. Garage Door Replacement Sunrise manor

Hi! This is my first visit to

Hi! This is my first visit to your blog! We are a team of volunteers and new initiatives in the same niche. Blog gave us useful information to work. You have done an amazing job! Karachi Chat Room

custom bags

A bag is an essential part of the customer experience, why not have it leave a lasting impression on your customers long after they have left your store. We take every bag project and try to design a bag that will be noticed by your customers and more importantly your potential customers. custom bags

I read this article. I think

I read this article. I think You put a great deal of exertion to make this article. I like your work. buy permanent twitter followers

I am always searching online

I am always searching online for storys that can accommodate me. There is obviously a multiple to understand about this. I feel you made few salubrious points in Attributes moreover. Detain busy, awesome career! ثبت شرکت در ثبت فردا

It is quite beneficial,

It is quite beneficial, although think about the facts when it reaches this target. دانلود آهنگ جدید

Bull & Bear Coffee Trading

Bull & Bear Coffee Trading Room & Club es el primer y único café trading a nivel mundial que nos ofrece la alternativa deaprender a hacer crecer nuestro dinero a través del mundo de las plataformas financieras en donde la única limitante eres tú.traiding

I am a new user of this site

I am a new user of this site so here i saw multiple articles and posts posted by this site,I curious more interest in some of them hope you will give more information on this topics in your next articles. เพลงชาติไทย

I use only high quality

I use only high quality materials - you can see them at: hairstyles for women

La GoldenAxes offre servizi

La GoldenAxes offre servizi di creazione siti web adatti a tutte le esigenze. Il tuo sito web avrà risultati perfetti sulla creazione ed il posizionamento sui motori di ricerca. realizzazione siti web

For true fans of this thread

For true fans of this thread I will address is a free online! under/over

I can recommend primarily

I can recommend primarily decent and even responsible tips, as a result view it: Privat rengøring priser

Guild Masters is like no

Guild Masters is like no other social RPG on Facebook. If you are looking for another repetitive "click-and-reward" game, this one is not for you. Guild Masters is a classic RPG, and the first true, online, social RPG on Facebook. browser game

Realcheaplikes is a social

Realcheaplikes is a social media promotion company which provide the services as facebook likes, youtube likes, youtube subscribers, instagram followers... We guarantee our services are real human, not bot and nondrop get twitter followers

Excellent read, Positive

Excellent read, Positive site, where did u come up with the information on this posting?I have read a few of the articles on your website now, and I really like your style. Thanks a million and please keep up the effective work. Get SoundCloud Plays

Denver Airport Car Service

Denver Airport Car Service provides safe airport transportation to and from denver airport. We provide black car ride to denver airport, airport car service, and transportation in colorado to dia. ride to denver airport

Took me time to understand

Took me time to understand all of the comments, but I seriously enjoyed the write-up. It proved being really helpful to me and Im positive to all of the commenters right here! Its constantly nice when you can not only be informed, but also entertained! I am certain you had enjoyable writing this write-up. watch tv series full episode

It is perfect time to make

It is perfect time to make some plans for the future and it is time to be happy. I've read this post and if I could I desire to suggest you some interesting things or suggestions. Perhaps you could write next articles referring to this article. I want to read more things about it! ChrisCaggs

Took me time to understand

Took me time to understand all of the comments, but I seriously enjoyed the write-up. It proved being really helpful to me and Im positive to all of the commenters right here! Its constantly nice when you can not only be informed, but also entertained! I am certain you had enjoyable writing this write-up. Compagnie de ménage Montréal

This is a fantastic article.

This is a fantastic article. Truly, one of the best articles that I've read in a long time. I was impressed very much to read this. I hope I'll get more stuff like this. 6 month loans

tiles.la จำหน่ายกระเบื้องrci,

tiles.la จำหน่ายกระเบื้องrci, RCI, Rci Tiles กระเบื้องอาร์ซีไอ ทุกรุ่นทุกขนาด ทั้งกระเบื้องปูพื้น และผนัง โดยบริษัท เดอะตรีทัช เอเชียแปซิฟิค จำกัด กระเบื้องปูพื้น

vit c serum

At this point you'll find out what is important, it all gives a url to the appealing page: vit c serum

sl786982

Corporate massage

It is quite beneficial, although think about the facts when it reaches this target. Corporate massage

sl786982

This content is simply

This content is simply astounding! There is no other article on the whole internet providing this rare information on this topic. You've earned the respect of many people today. I just wish you will continue to provide more rare stuff like this. shutters perth

sl786982

Good post. I learn some thing tougher on distinct blogs everyday. Most commonly it really is stimulating to learn to read content material from other writers and exercise a specific thing there. Wall Decor Stickers

sl786982

sl786982

Acknowledges for penmanship such a worthy column, I stumbled beside your blog besides predict a handful advise. I want your tone of manuscript... the power of conversational hypnosis

sl786982

Post new comment

CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.