[jira] [Commented] (SHIRO-170) Force New Session ID on Authentication

["amit yatagiri (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SHIRO-170?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14348526#comment-14348526 ] 

amit yatagiri commented on SHIRO-170:
-------------------------------------

session.stop creates one cookie(with deleteme as value) and after login one more cookie adds to response with the same name? Should client take care of the order of cookies here?? 
Worst case, before session.stop gets called, and if session gets created in any previous layers there will be 3 cookies !!
Any workarounds? :)

> Force New Session ID on Authentication
> --------------------------------------
>
>                 Key: SHIRO-170
>                 URL: https://issues.apache.org/jira/browse/SHIRO-170
>             Project: Shiro
>          Issue Type: New Feature
>          Components: Authentication (log-in), Configuration
>    Affects Versions: 1.0.0, 1.1.0, 1.2.0
>            Reporter: Jakob Külzer
>            Priority: Minor
>             Fix For: 1.3.0
>
>
> I am working on an application that has very high security standards. One of the issues raised after a full audit of the app is that it might be vulnerable for session fixation attacks. Shiro does not reset the Session ID after successful authentication, which would prevent this type of attack. 
> IMHO this would add another level of security to Shiro beneficial for all kinds of applications. 
> OWASP has a good page on session fixation attacks: http://www.owasp.org/index.php/Session_fixation



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)