Home page logo

webappsec logo WebApp Sec mailing list archives

Re: Hijacking URL Encoded Session IDs using Referer Logs
From: "Jeff Dafoe" <jeff () badtz-maru com>
Date: Mon, 25 Nov 2002 10:01:44 -0500

Many (most?) application servers use URL encoded session IDs when the
user has disabled cookies. Many users disable cookies as a security
precaution. There should be an advisory on this so that application
server vendors stop allowing URL encoded session IDs by default.

    If the sessions in a particular app are that easy to hijack then the
security issue is with that and not necessarily with the method used to
transmit the session id.  That is why the origin of a request must be
validated when a request is issued against a particular session and it is
also why sessions must be expired in a timely fashion.  I think we are
treading old territory here, stuff that was previously covered in past "poor
session handling" advisories and such.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]