[
https://issues.apache.org/jira/browse/WW-5841?focusedWorklogId=1053203&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053203
]
ASF GitHub Bot logged work on WW-5841:
--------------------------------------
Author: ASF GitHub Bot
Created on: 07/Nov/26 09:35
Start Date: 07/Nov/26 09:35
Worklog Time Spent: 10m
Work Description: g0w6y opened a new pull request, #2117:
URL: https://github.com/apache/struts/pull/2117
Fixes [WW-5841](https://issues.apache.org/jira/browse/WW-5841)
Without a `web.xml`, the embedded Tomcat context `StrutsBootServer` starts
defaulted to the servlet-spec COOKIE+URL session tracking modes, so a session
id supplied only via `;jsessionid=` in the URL (no cookie at all) was accepted
and kept alive with no fresh `Set-Cookie`. Live-reproduced before this fix: a
session established by cookie was resumed by replaying the id via the URL
parameter with no Cookie header sent at all.
Restricts session tracking to COOKIE only, and the session cookie now
carries `SameSite=Lax`. Boot is part of 7.5.0, unreleased, so this lands before
anyone is exposed to it.
**Verified:** `StrutsBootTomcatTest` gains `testSessionCookieHasSameSiteLax`
and a URL-supplied-session-id test, with a cookie-based-session control. Full
`boot`: 52/0 failures.
Issue Time Tracking
-------------------
Worklog Id: (was: 1053203)
Remaining Estimate: 0h
Time Spent: 10m
> Struts Boot accepts a session id via URL ;jsessionid= with no cookie and no
> SameSite
> ------------------------------------------------------------------------------------
>
> Key: WW-5841
> URL: https://issues.apache.org/jira/browse/WW-5841
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Reporter: Gouri Sankar A
> Priority: Minor
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Without a web.xml, the embedded Tomcat context StrutsBootServer starts
> defaulted to the servlet-spec COOKIE+URL session tracking modes, so a session
> id supplied only via ";jsessionid=" in the URL (no cookie at all) was
> accepted and kept alive with no fresh Set-Cookie -- a session-fixation vector.
> Live-reproduced before this fix: a session established by cookie was resumed
> by replaying the id via the URL parameter with no Cookie header sent at all.
> Fix restricts session tracking to COOKIE only, and the session cookie now
> carries SameSite=Lax (previously unset). Secure is deliberately not forced:
> Boot opens a plain HTTP listener by default, and an operator terminating TLS
> in front of it sets Secure themselves, as with any other servlet container.
> Boot is part of 7.5.0 (unreleased, no production deployments yet), so this
> lands before anyone is exposed to it.
> Tests: StrutsBootTomcatTest gains testSessionCookieHasSameSiteLax and a
> URL-supplied-session-id-is-not-honoured test, with a
> cookie-based-session-still-works control. Full boot suite: 52/0 failures.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
