Tomcat session management – url rewrite and switching from http to https

by

It doesn’t seem desirable to maintain session between HTTP and HTTPS using the same cookie or URL token.

Imagine the case where you’re user is logged on, with a given cookie (or URL token) passed back and forth for every request/response in an e-commerce website. If someone in the middle is able to read that cookie, he can then log on to the HTTP or HTTPS variant of the site with it. Even if whatever the legitimate user is then doing is over HTTPS, the attacker will still be able to access that session (because he too will have the legitimate cookie). He could see pages like the cart, the payment method, perhaps change the delivery address.

It makes sense to pass some form of token between the HTTP session and the HTTPS session (if you’re using sessions), but treating them as one and the same would cause some vulnerability. Creating a one-off token in the query parameter just the transition could be a solution. You should however treat them as two separate authenticated sessions.

This vulnerability can happen sometimes with websites that use mixed HTTP and HTTPS content (certain browsers such as Firefox will give you a warning when that happens, although most people tend to disable it the first time it pops up). You could have your HTTPS session cookie for the main page, but that page contains images for the company logo, over plain HTTP. Unfortunately, the browser would send the cookie for both (so the attacker would be able the cookie then). I’ve seen it happen, even if the image in question wasn’t even there (the browser would send the request with the cookie to the server, even if it returned a 404 not found).

More Related Contents:

  1. When should I use a trailing slash in my URL?
  2. How to change the URL from “localhost” to something else, on a local system using wampserver?
  3. URL rewriting with PHP
  4. How to get Url Hash (#) from server side
  5. URL encoding the space character: + or %20?
  6. How can I create friendly URLs with .htaccess?
  7. Does a `+` in a URL scheme/host/path represent a space?
  8. Is there a way to change the browser’s address bar without refreshing the page?
  9. slashes in url variables
  10. Should URL be case sensitive?
  11. What are the safe characters for making URLs?
  12. What does a dot mean in a URL path?
  13. Session lost when switching from HTTP to HTTPS in PHP
  14. Passing parameter via url to sql server reporting service
  15. url with multiple forward slashes, does it break anything?
  16. What’s the best way to get the current URL in Spring MVC?
  17. Is a colon `:` safe for friendly-URL use?
  18. Encoding of XHTML and & (ampersand)
  19. delete version number in url
  20. Encode / decode URLs
  21. COMPLETE list of HTML tag attributes which have a URL value?
  22. If you use HTTPS will your URL params will be safe from sniffing? [duplicate]
  23. Browser support for URLs beginning with double slash
  24. Add parameters to the URL (redirect) via a Greasemonkey/Tampermonkey/Userscript
  25. Weird characters in URL
  26. IIS URL Rewrite not working with query string
  27. Different result when using GET/POST in elastic search
  28. GitHub source dynamic navigation
  29. Does VBA have any built in URL decoding?
  30. Is array syntax using square brackets in URL query strings valid?

Leave a Comment