-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Akash,
On 5/8/14, 9:56 PM, Akash Jain wrote: > Hi, > > I am trying to resolve session fixation issue with tomcat 7.0.52 > > We have a Spring MVC application running on it, and the Auth method > is provided by another application which writes cookie, and we use > the cookie value to check whether the user is valid or not. > > My application URL patterns are / - Home page /login - Redirect to > another application to ask user to authenticate /myaccess/user*** > --> All authenticated URL's > > <Context path="" docBase="myapplication" > sessionCookieName="mycookiename" > sessionCookieDomain="application.mydomain.com > sessionCookiePath="/"> > > As I cannot use org.apache.catalina.authenticator.FormAuthenticator > here. > > How can i prevent the session fixation ? If you are managing the authentication yourself, then you'll have to handle (mitigate) session fixation yourself, too. You can invalidate and create a new session in the same request, if you want. - -chris -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJTeNMIAAoJEBzwKT+lPKRYje4P/i1LD+r06I1VuI6jtFAzM/0k Ow/HyXyyFRIq3zz1+LUQ8ys2PEROTw+E7q3NzLvBb8e6Vngc2vWBoRq7jps1r4Jq h/5Cd4k7DI5V5dlPFph7nHNXwKbGgRtCamvhwC/fQFlZxwvGTOfAyxeYLT42k3zF x3HkesQSI9F4hfy9VzQ8977cTICUI8bz5pUksRccN9uFJ5A1V18vdjDEJ7hWkS8K V5lPr0VlZ9XzNOZ9conQYoZnuOzvl9l73QECTJi8jSPeVHGGEFcQmVE2KCxExx4u qqN0twycISY/TrLxt74WkiJseljzr+QXZUjFHIlaepU62/pVmOwBQHs9bs1e7jHo YNSY/8g+W0nKvLexgULJw1FBpxlq2LcTtkRzPDPEuTp0OlE583bPufxd+LaoLwL3 uWEtkhMSNiMsChyCigBsaZZVhkY8DzmSQ2SYpZmGx3suyJmllt/yiET+vc2uRAxn 6iBKvrSrwzDnqwpMpeowpU69n5v12+yRNts5PCOksLJ61TDV59C2AvUE3CWJI417 M163/01GEF9yux5/7cm7jYJpEDdqS3+y1vLC4E9I7BXkpLuuPmVAUcbl7VPVl12X h5wZsbdFX9xZsIoDPkLlZv8+0ugp/BlLwVqNRNfnNusLQl4OHF/hlj1eWIDBQsEJ G8FbWFqolK+tUemVOO1v =UHeH -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
