Uploaded image for project: 'Shiro'
  1. Shiro
  2. SHIRO-536

Session token in url

    XMLWordPrintableJSON

Details

    Description

      Hello Team,

      As we know that this is one of the vulnerability challenges where we are supposed to remove JSESSIONID from the url.

      I observed that there is a possibility with the plain servlet api 3.x version with the web.xml configuration which disables the JSESSIONID from the url is

      <session-config>
      <tracking-mode>COOKIE</tracking-mode>
      </session-config>

      But shiro will identify and reads the above configuration if and only if shiro xml contains session manager configuration with the class
      <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.ServletContainerSessionManager"></bean>

      But the limitations with above class are....

      1) No session listeners configuration
      2) No Session dao configuration
      3) No Session validation scheduler configuration
      4) No invalid session deletion configuration
      ...
      ...
      etc

      But removing session token from the url is possible with this.

      To achieve all the above limitations i am using the following session manager

      <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager"></bean>

      But with this i unable to hide session token from the url as it doesnt read web.xml configuration and context.xml...etc

      Does anybody having any work around this or is there any other session manger which will include both above 2 session managers functionality so that i can achieve all the above limitations and the session token issue.

      I am facing the issues with these insufficient configuration, Could anybody please suggest the way forward..

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              nagaraju.kurma@gmail.com Nagaraju Kurma
              Votes:
              2 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: