spring-projects / spring-projects/spring-security
SEC-2692: Tomcat's session fixation protection conflicts with concurrency control
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
George Angeletos (Migrated from SEC-2692) said:
By default in Tomcat 7 the session fixation protection is enabled. That means that if you are using SSL mutual (client-cert) authentication (Tomcat side) and form-login authentication with SS the concurrency control is effectively bypassed.
In order for the CompositeSessionAuthenticationStrategy to properly work the changeSessionIdOnAuthentication attribute must be set to false on the SSLAuthenticator in /conf/context.xml:
<Valve className="org.apache.catalina.authenticator.SSLAuthenticator" changeSessionIdOnAuthentication="false" />
Please add a warning in the documentation (http://docs.spring.io/spring-security/site/docs/3.2.4.RELEASE/reference/htmlsingle/#concurrent-sessions) as it's a big frustration - at least it was for me :)
Regards,
George
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the concurrent sessions section of the Spring Security reference documentation linked in the issue and verify the Tomcat 7 session-fixation interaction described there. Done means adding a clear warning about the SSLAuthenticator changeSessionIdOnAuthentication setting for mutual SSL and form-login authentication.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, documentation
- Issue type
- Documentation
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100