[
https://issues.apache.org/jira/browse/WW-5841?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart resolved WW-5841.
-------------------------------
Resolution: Fixed
> Struts Boot accepts a session id via URL ;jsessionid= with no cookie and no
> SameSite
> ------------------------------------------------------------------------------------
>
> Key: WW-5841
> URL: https://issues.apache.org/jira/browse/WW-5841
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> StrutsBootServer embeds Tomcat and does not set a session tracking mode, so
> the context
> falls back to Tomcat's default of COOKIE and URL. The session cookie also has
> no SameSite
> attribute.
> Effects on main:
> - A session id sent in the URL (/app.action;jsessionid=<id>) is accepted as
> the session.
> - Tomcat's encodeURL appends ;jsessionid=<id> to links generated by <s:url>
> and <s:a>,
> which puts the session id in rendered pages and in Referer headers.
> - Set-Cookie for JSESSIONID carries no SameSite attribute.
> Fix: restrict the context to cookie-only session tracking and set
> SameSite=Lax on the
> session cookie. THREAT_MODEL.md section 5 lists both as Boot defaults.
> Secure is not forced, because the embedded connector is plain HTTP
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
