[jira] [Commented] (SHIRO-170) Force New Session ID on Authentication

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

[jira] [Commented] (SHIRO-170) Force New Session ID on Authentication

JIRA jira@apache.org

    [ https://issues.apache.org/jira/browse/SHIRO-170?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15814385#comment-15814385 ]

renjini commented on SHIRO-170:

Is anyone has any idea about "Re-set the value of the JSESISONID cookie after successful authentication via Shiro".

> Force New Session ID on Authentication
> --------------------------------------
>                 Key: SHIRO-170
>                 URL: https://issues.apache.org/jira/browse/SHIRO-170
>             Project: Shiro
>          Issue Type: New Feature
>          Components: Authentication (log-in), Configuration
>    Affects Versions: 1.0.0, 1.1.0, 1.2.0
>            Reporter: Jakob K├╝lzer
>            Priority: Minor
>             Fix For: 2.0.0
> I am working on an application that has very high security standards. One of the issues raised after a full audit of the app is that it might be vulnerable for session fixation attacks. Shiro does not reset the Session ID after successful authentication, which would prevent this type of attack.
> IMHO this would add another level of security to Shiro beneficial for all kinds of applications.
> OWASP has a good page on session fixation attacks: http://www.owasp.org/index.php/Session_fixation

This message was sent by Atlassian JIRA