Edit Question - KnowledgeHub

Title Body

In my web.xml I've defined a user-data-constraint for some resources: <security-constraint> <web-resource-collection> <web-resource-name>Personal Area</web-resource-name> <url-pattern>/personal/*</url-pattern> </web-resource-collection> <web-resource-collection> <web-resource-name>User Area</web-resource-name> <url-pattern>/user/*</url-pattern> </web-resource-collection> <user-data-constraint> <transport-guarantee>CONFIDENTIAL</transport-guarantee> </user-data-constraint> </security-constraint> When I load the page with http I've got my JSESSIONID ID1 in my cookie. When I change to context/user/sample.faces then Tomcat makes a 302 redirect to HTTPS. But my JSESSIONID is still ID1. I think this is a vulnerability? Or is it my configuration mistake? The problem I see is the following: While browsing over HTTP with cookie ID1 there is an attacker who is listening to my network traffic. He "steals" my cookie ID1. Now I switch to HTTPS and my cookie is still ID1. I login. The attacker is then able to taker over my session because he knows my cookie...

Tags (comma-separated) Cancel