Session Fixation - Replacing JSESSIONID after login

Questions
1

Hi,

We have been investigating the possibility of replacing the JSESSIONID of the Web Client session after login.

The rationale for this is to mitigate a session fixation attack.

http://www.owasp.org/index.php/Session_Fixation

It seems that there is a nice wicket function that should do just that called “replaceSession()”.

We have tried to use this in Servoy (8.1.2) by calling:

Packages.org.apache.wicket.Session.get().replaceSession();

This does change the JESSIONID but also then takes us to the solution browsing page.

Is there a way to change the JSESSIONID after login and if so, how can this be achieved?

Cheers,

Mark

2

This doesn’t directly answer your question, but there are some alternatives. When a session is initiated, you could store the IP and Session in a temporary table. Or use a JS Fingerprint library to store a browser fingerprint hash with the session ID in the temporary table.
At session creation, check if the session exists in the table already. If so, if it’s under a different ip and/or fingerprint hash, then you block the login session from being shown as that would mean the browser is attempting to load a session of a different user.

3

Hi Scott,

Many thanks for responding to this.

I like your alternative suggestion. Particularly the browser fingerprint hash. That’s neat.

If there is no possibility of being able to just change the JSESSIONID after login, then this approach could meet the requirement.

Can anyone confirm for sure whether changing the JSESSIONID after login is currently technically possible or not?

Thanks,

Mark