[Security & JAAS/JBoss] - jesssionid and URL rewriting
by gulloo
Guys,
I am having an issue here:
Platform : JBoss-4.04 on redhat
when a user logs in to our application( form based auth ), he gets redirected to the home landing page with the URL showing as
http://salesgene.demo.salesgene.com/salesgene-home.faces;jsessionid=EECFD...
here is the scenario:
1. cookies are enabled.
2. however the presence of jsessionid in the URL ...causes me to beleive that this is susceptible to session hijacking
3. I used the open-source ?wget? command line tool to fetch the pages, I contructed thr following command line from a different PC
wget --header 'Cookie: JSESSIONID=EECFDDBE78B3779711625CA0C5BE634C' 'http://salesgene.demo.salesgene.com/salesgene-home.faces' -O home.html --post-data
This will retrieve the HTML of the home page for the user whose sessionID I copied.
This is obviously a big security hole, and it stems from the fact that I can see the jsessionid in the URL. even https does not help in this case.
my questions to all the gurus
-any architecture suggestions to overcome this.
-how do I supress the jsessionid coming up in the URL ....If that is possible, because once that happens and if we use SSL then we can be sure that our http headers are encrypted and the jsessionid is not visible to sniffers.
-this test obviously fails on a browser, if I try to hijack a session ID and try to use it on a new browser instance ...I get the login page of our app, the problem is exposed only if i use telnet to port 80 or a tool like wget.
any help is appreciated.
thanks,
Sanjay Gulati
-
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3971703#3971703
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3971703
19 years, 8 months
[JBoss Seam] - Re: Unexpected element zipfileset
by clockdva
i have installed jdk5 and when i run jboss:
Could not locate C:\jdk1.5.0_08\lib\tools.jar. Unexpected results may occur.
Make sure that JAVA_HOME points to a JDK and not a JRE.
===============================================================================
.
JBoss Bootstrap Environment
.
JBOSS_HOME: C:\Programmi\jboss-4.0.4.GA\bin\\..
.
JAVA: C:\jdk1.5.0_08\bin\java
.
JAVA_OPTS: -Dprogram.name=run.bat -Xms128m -Xmx512m -Dsun.rmi.dgc.client.gcIn
terval=3600000 -Dsun.rmi.dgc.server.gcInterval=3600000
.
CLASSPATH: C:\jdk1.5.0_08\lib\tools.jar;C:\Programmi\jboss-4.0.4.GA\bin\\run.j
ar
.
===============================================================================
.
The system cannot find the path specified.
Press any key to continue . . .
classpath:
.;J:\D2\front242\NONCENTRANOdaLuglio2005\esempiMIEI\ereditarieta\New Folder;C:\jdk1.5.0_08\lib;C:\Program Files\Apache Group\Tomcat 4.1\common\lib\servlet.jar
javahome:
C:\jdk1.5.0_08
path:
%PATH%;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%JAVA_HOME%\bin;C:\jdk1.5.0_08\bin;%ANT_HOME%\bin;C:\PHP
what can i do?
thanks, you are very kind
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3971701#3971701
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3971701
19 years, 8 months