[JS2-1359] Retain Session on Login Feature broken

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.3.1
• Fix Version/s: 2.3.2
• Component/s: Security
• Assignee: David Sean Taylor
• Reporter: David Sean Taylor
• Due: 01/Dec/17
• Created: 30/Nov/17 19:04
• Updated: 30/Nov/17 19:09
• Resolved: 30/Nov/17 19:09

Description

With Tomcat 6, keeping the same session from guest state to logged in state was default behavior. With Tomcat 7, to address Session Fixation attacks, this behavior was locked down, see:

https://www.developer.com/java/web/article.php/3904871/Top-7-Features-in-Tomcat-7-The-New-and-the-Improved.htm

Tomcat 7 and 8 suports a setting in context.xml to configure this behavior:

https://tomcat.apache.org/tomcat-7.0-doc/config/valve.html

changeSessionIdOnAuthentication

Controls if the session ID is changed if a session exists at the point where users are authenticated. This is to prevent session fixation attacks. If not set, the default value of true will be used.

<Valve className="org.apache.catalina.authenticator.FormAuthenticator" characterEncoding="UTF-8" changeSessionIdOnAuthentication="false"/>