[jira] [Comment Edited] (SHIRO-170) Force New Session ID on Authentication

["Nagaraju Kurma (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SHIRO-170?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14619955#comment-14619955 ] 

Nagaraju Kurma edited comment on SHIRO-170 at 7/9/15 5:56 AM:
--------------------------------------------------------------

Hello,
Could anybody give me the full pledged code to extend AuthenticationFilter and overriding the required method with the executable code which will solve the issue "Force New Session ID on Authentication"

I unable to override onLoginSuccess(-), onLoginFailure(-) methods


was (Author: nagaraju.kurma@gmail.com):
Hello,
Could anybody give me the full pledged code to extend AuthenticationFilter and overriding the required method with the executable code which will solve the issue "Force New Session ID on Authentication"

> Force New Session ID on Authentication
> --------------------------------------
>
>                 Key: SHIRO-170
>                 URL: https://issues.apache.org/jira/browse/SHIRO-170
>             Project: Shiro
>          Issue Type: New Feature
>          Components: Authentication (log-in), Configuration
>    Affects Versions: 1.0.0, 1.1.0, 1.2.0
>            Reporter: Jakob Külzer
>            Priority: Minor
>             Fix For: 1.3.0
>
>
> I am working on an application that has very high security standards. One of the issues raised after a full audit of the app is that it might be vulnerable for session fixation attacks. Shiro does not reset the Session ID after successful authentication, which would prevent this type of attack. 
> IMHO this would add another level of security to Shiro beneficial for all kinds of applications. 
> OWASP has a good page on session fixation attacks: http://www.owasp.org/index.php/Session_fixation



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)