Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Talking generally (because this isn't a Java problem at all, it's a general web problem) session fixation arises when session IDs are easy to discover or guess. The main method of attack is when the session ID is in the URL of a page, for example <a href="http://example.com/index?sessionId=123" rel="nofollow noreferrer">http://example.com/index?sessionId=123</a>. An attacker could setup capture a session and then embed the link in their page, tricking a user into visiting it and becoming part of their session. Then when the user authenticates the session is authenticated. The mitigation for this is to not use URL based session IDs, but instead use cookies</p> <p>Some web applications will use a cookie session based but set it from the initial URL, for example visiting <a href="http://example.com/index?sessionId=123" rel="nofollow noreferrer">http://example.com/index?sessionId=123</a> would see the session id in the url and then create a session cookie from it, setting the id in the session cookie to 123. The mitigation for this is to generate random session ids on the server without using any user input as a seed into the generator.</p> <p>There's also browser based exploits where a poorly coded browser will accept cookie creation for domains which are not the originating domain, but there's not much you can do about that. And Cross Site Scripting attacks where you can send a script command into the attacked site to set the session cookie, which can be mitigated by setting the session cookie to be HTTP_ONLY (although Safari does not honour this flag)</p> <p>For Java the general recommendation is</p> <pre><code>session.invalidate(); session=request.getSession(true); </code></pre> <p>However at one point on JBoss this didn't work - so you need to check this works as expected within your chosen framework.</p>
    singulars
    1. This table or related slice is empty.
    1. POJava secure session
      singulars
      1. PTQuestion
    1. PTAnswer
    1. This table or related slice is empty.
    1. USblowdart
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COI try using this method, but the user will be logout is session.invalidate() is called
      singulars
      1. PO
      1. This table or related slice is empty.
    2. COWell then that's a limitation of the framework you are using I'm afraid.
      singulars
      1. PO
      1. USblowdart
    3. COi am using jsf and tomcat, so got any other method to solve the problem?
      singulars
      1. PO
      1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload