Is a session fixation attack / session hijack possible in JBoss and Seam?

Solution Verified - Updated -

Issue

  • In certain circumstances, we were able to fixate the session for users that previously had not visited our site, shouldn't Seam be safe from even this session fixation?
  • How can I prevent a session fixation attack in JBoss?
  • When a user logs in the first time, a new session is created for them. If the same user login from another machine when his previous session is still valid. In this case we like to invalidate the previous session and create a new session for the user. How can we do this?

Environment

  • JBoss Enterprise Application Platform (EAP)
    • 4.2
    • 4.3
    • 5
  • Seam 1.2
  • Seam 2

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.