[WAVE-133] Security: We need to generate a new session id when user logs in.

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Component/s: Server
• Labels: security
• Assignee: Unassigned
• Reporter: Anonymous
• Created: 28/Apr/11 18:24
• Updated: 20/Apr/15 22:47

Description

We are should generate a new session see code here:
http://code.google.com/p/wave-protocol/source/browse/src/org/waveprotocol/box/server/rpc/AuthenticationServlet.java#127

This can be a security vulnerability.

—
Issue imported from http://code.google.com/p/wave-protocol/issues/detail?id=132

Owner: [e-mail]
Label: Type-Defect
Label: Priority-Medium
Stars: 1
State: open
Status: Accepted