[
https://issues.apache.org/jira/browse/WW-5841?focusedWorklogId=1053352&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053352
]
ASF GitHub Bot logged work on WW-5841:
--------------------------------------
Author: ASF GitHub Bot
Created on: 08/Nov/26 03:30
Start Date: 08/Nov/26 03:30
Worklog Time Spent: 10m
Work Description: g0w6y commented on PR #2117:
URL: https://github.com/apache/struts/pull/2117#issuecomment-6716733480
Addressed in bfc956e43:
- `THREAT_MODEL.md` ยง5: added "session tracking is cookie-only" and "the
session cookie carries `SameSite=Lax`" to the Boot container defaults list
- dropped the `Secure` claim from the Javadoc; the remaining Javadoc is two
lines
- `setSessionTrackingModes` now lives in the same method as the cookie
processor, renamed `restrictSessionTracking(Context)`; the registry initializer
is back to its original one-liner
- comments reduced to what the code does; test Javadocs are one line each
and the `// GREEN:` lines are gone
- PR title changed to the repo form
I'll update the ticket text to drop the `Secure` sentence and add the
`<s:url>`/`<s:a>` link effect. Full `boot` suite: 52/0 failures; both new tests
fail against `main`'s `StrutsBootServer`.
Issue Time Tracking
-------------------
Worklog Id: (was: 1053352)
Time Spent: 0.5h (was: 20m)
> Struts Boot accepts a session id via URL ;jsessionid= with no cookie and no
> SameSite
> ------------------------------------------------------------------------------------
>
> Key: WW-5841
> URL: https://issues.apache.org/jira/browse/WW-5841
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Without a web.xml, the embedded Tomcat context StrutsBootServer starts
> defaulted to the servlet-spec COOKIE+URL session tracking modes, so a session
> id supplied only via ";jsessionid=" in the URL (no cookie at all) was
> accepted and kept alive with no fresh Set-Cookie -- a session-fixation vector.
> Live-reproduced before this fix: a session established by cookie was resumed
> by replaying the id via the URL parameter with no Cookie header sent at all.
> Fix restricts session tracking to COOKIE only, and the session cookie now
> carries SameSite=Lax (previously unset). Secure is deliberately not forced:
> Boot opens a plain HTTP listener by default, and an operator terminating TLS
> in front of it sets Secure themselves, as with any other servlet container.
> Boot is part of 7.5.0 (unreleased, no production deployments yet), so this
> lands before anyone is exposed to it.
> Tests: StrutsBootTomcatTest gains testSessionCookieHasSameSiteLax and a
> URL-supplied-session-id-is-not-honoured test, with a
> cookie-based-session-still-works control. Full boot suite: 52/0 failures.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
