spring-projects / spring-projects/spring-security
SEC-2126: Session fixation attacks possible when specifying authentication filter unless explicitly prevented
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Neil Taylor (Migrated from SEC-2126) said:
Spring security prevents session fixation attacks by default, but this is negated if an authentication filter is used such as CasAuthenticationFilter. In this case the user must explicitly set the SessionAuthenticationStrategy as below;
This is not obvious to a user and the example given at http://static.springsource.org/spring-security/site/docs/3.0.x/reference/cas.html is vulnerable.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the CAS reference example linked in the issue and inspect how CasAuthenticationFilter handles SessionAuthenticationStrategy. Confirm whether the example prevents session fixation without requiring an easily missed explicit setting; the issue is done when the vulnerable example or configuration is corrected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100