Re: JSESSIONID changed without notice

2016-04-11 Thread Felix Schumacher
Am Montag, den 11.04.2016, 10:22 + schrieb Arno Schäfer: > Hi Felix, > > thank you very much for that hint. > > > When a session gets 'authenticated' its id will change to prevent > > session fixation attacks. If you are interested in the events telling > > you the change you have two possi

Re: JSESSIONID changed without notice

2016-04-11 Thread Arno Schäfer
Hi Felix, thank you very much for that hint. > When a session gets 'authenticated' its id will change to prevent > session fixation attacks. If you are interested in the events telling > you the change you have two possibilities: ok, that explain, what I see :-) > 1. Use servlet api 3.1 and u

Re: JSESSIONID changed without notice

2016-04-09 Thread Felix Schumacher
Am 07.04.2016 um 17:40 schrieb Arno Schäfer: Hi all, I have the following Problem: we have a very old, some kind of complex webapp, that run under tomcat 7.0.54 on Windows. I have to maintain some functionality and came to a point, what I can't understand. Some requests have to have an authent

JSESSIONID changed without notice

2016-04-07 Thread Arno Schäfer
Hi all, I have the following Problem: we have a very old, some kind of complex webapp, that run under tomcat 7.0.54 on Windows. I have to maintain some functionality and came to a point, what I can't understand. Some requests have to have an authentification and this is bound at the JSESSIONID.