JSP directive session=“false”

Question

If I don't use session="false" directive in the Login page in the web application, will jSESSIONID be created in Login page itself.

Also then is it possible to hack the application and access the files by using the created jSESSIONID , without even login authentication , just by visting the Login page.

Your response is highly appreciated.

Thanks, Pradeep G

Answer 1

Here is one possible attack vector:

1. You open the login page, but don't log in, because it is lunch time.

2. Bad Actor walks into your office, writes down your jSESSIONID.

3. After lunch, you log in. That jSESSIONID is now useful.

4. Bad Actor can use your jSESSIONID from his own browser to look at your session.

Solution:

Create a brand-new jSESSIONID after the successful login (so that the one from before authentication does not suddenly become valuable).