Gouri Sankar A created WW-5841:
----------------------------------
Summary: Struts Boot accepts a session id via URL ;jsessionid=
with no cookie and no SameSite
Key: WW-5841
URL: https://issues.apache.org/jira/browse/WW-5841
Project: Struts 2
Issue Type: Improvement
Components: Core
Reporter: Gouri Sankar A
Without a web.xml, the embedded Tomcat context StrutsBootServer starts
defaulted to the servlet-spec COOKIE+URL session tracking modes, so a session
id supplied only via ";jsessionid=" in the URL (no cookie at all) was accepted
and kept alive with no fresh Set-Cookie -- a session-fixation vector.
Live-reproduced before this fix: a session established by cookie was resumed by
replaying the id via the URL parameter with no Cookie header sent at all.
Fix restricts session tracking to COOKIE only, and the session cookie now
carries SameSite=Lax (previously unset). Secure is deliberately not forced:
Boot opens a plain HTTP listener by default, and an operator terminating TLS in
front of it sets Secure themselves, as with any other servlet container.
Boot is part of 7.5.0 (unreleased, no production deployments yet), so this
lands before anyone is exposed to it.
Tests: StrutsBootTomcatTest gains testSessionCookieHasSameSiteLax and a
URL-supplied-session-id-is-not-honoured test, with a
cookie-based-session-still-works control. Full boot suite: 52/0 failures.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
