[
https://issues.apache.org/jira/browse/WW-5841?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5841:
------------------------------
Fix Version/s: 7.5.0
> Struts Boot accepts a session id via URL ;jsessionid= with no cookie and no
> SameSite
> ------------------------------------------------------------------------------------
>
> Key: WW-5841
> URL: https://issues.apache.org/jira/browse/WW-5841
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Without a web.xml, the embedded Tomcat context StrutsBootServer starts
> defaulted to the servlet-spec COOKIE+URL session tracking modes, so a session
> id supplied only via ";jsessionid=" in the URL (no cookie at all) was
> accepted and kept alive with no fresh Set-Cookie -- a session-fixation vector.
> Live-reproduced before this fix: a session established by cookie was resumed
> by replaying the id via the URL parameter with no Cookie header sent at all.
> Fix restricts session tracking to COOKIE only, and the session cookie now
> carries SameSite=Lax (previously unset). Secure is deliberately not forced:
> Boot opens a plain HTTP listener by default, and an operator terminating TLS
> in front of it sets Secure themselves, as with any other servlet container.
> Boot is part of 7.5.0 (unreleased, no production deployments yet), so this
> lands before anyone is exposed to it.
> Tests: StrutsBootTomcatTest gains testSessionCookieHasSameSiteLax and a
> URL-supplied-session-id-is-not-honoured test, with a
> cookie-based-session-still-works control. Full boot suite: 52/0 failures.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
