[
https://issues.apache.org/jira/browse/WW-5841?focusedWorklogId=1053401&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053401
]
ASF GitHub Bot logged work on WW-5841:
--------------------------------------
Author: ASF GitHub Bot
Created on: 08/Nov/26 14:58
Start Date: 08/Nov/26 14:58
Worklog Time Spent: 10m
Work Description: lukaszlenart merged PR #2117:
URL: https://github.com/apache/struts/pull/2117
Issue Time Tracking
-------------------
Worklog Id: (was: 1053401)
Time Spent: 40m (was: 0.5h)
> Struts Boot accepts a session id via URL ;jsessionid= with no cookie and no
> SameSite
> ------------------------------------------------------------------------------------
>
> Key: WW-5841
> URL: https://issues.apache.org/jira/browse/WW-5841
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> StrutsBootServer embeds Tomcat and does not set a session tracking mode, so
> the context
> falls back to Tomcat's default of COOKIE and URL. The session cookie also has
> no SameSite
> attribute.
> Effects on main:
> - A session id sent in the URL (/app.action;jsessionid=<id>) is accepted as
> the session.
> - Tomcat's encodeURL appends ;jsessionid=<id> to links generated by <s:url>
> and <s:a>,
> which puts the session id in rendered pages and in Referer headers.
> - Set-Cookie for JSESSIONID carries no SameSite attribute.
> Fix: restrict the context to cookie-only session tracking and set
> SameSite=Lax on the
> session cookie. THREAT_MODEL.md section 5 lists both as Boot defaults.
> Secure is not forced, because the embedded connector is plain HTTP
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
