[jira] Commented: (SHIRO-170) Force New Session ID on Authentication

["Kalle Korhonen (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SHIRO-170?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12920086#action_12920086 ] 

Kalle Korhonen commented on SHIRO-170:
--------------------------------------

I'm somewhat against forcing this on users of Shiro. There are perfectly good use cases for preserving the same session on login, though I typically re-create a new one in all of my web applications. It's super simple to do. Perhaps this could be implemented as the default but overridable option - that I could agree with. For 1.1.0, simplest path to close and recommend invalidating session after logout in the docs.

> Force New Session ID on Authentication
> --------------------------------------
>
>                 Key: SHIRO-170
>                 URL: https://issues.apache.org/jira/browse/SHIRO-170
>             Project: Shiro
>          Issue Type: New Feature
>          Components: Authentication (log-in), Configuration
>    Affects Versions: 1.0.0
>            Reporter: Jakob Külzer
>            Priority: Minor
>             Fix For: 1.1.0
>
>
> I am working on an application that has very high security standards. One of the issues raised after a full audit of the app is that it might be vulnerable for session fixation attacks. Shiro does not reset the Session ID after successful authentication, which would prevent this type of attack. 
> IMHO this would add another level of security to Shiro beneficial for all kinds of applications. 
> OWASP has a good page on session fixation attacks: http://www.owasp.org/index.php/Session_fixation

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.