Shulou(Shulou.com)06/02 Report--

An example analysis of fixing the vulnerability of shiro fixed session attack. In view of this problem, this article introduces the corresponding analysis and solution in detail, hoping to help more partners who want to solve this problem to find a more simple and feasible method.

Fixed session attack (session fixation attack) is by giving the attacked person a URL address with session information, and then inducing him to log in. If the session information remains unchanged after login, the session provided by the attacker becomes the login state. The Servlet container allows the addition of URL addresses; JSESSIONID=... The way to carry session information.

So when logging in, the original session must be invalidated and a new session must be generated. It should be noted here that using logout does not invalidate session, but rather uses the stop method of session. The code is as follows:

Subject subject = getSubject (request, response); / / subject.logout () cannot be used here; this method cannot invalidate session, and the original session will continue to be used after login. Subject.getSession (). Stop (); subject.getSession (true); subject.login (token); this is the answer to the sample analysis question about repairing the vulnerability of shiro fixed session attack. I hope the above content can be of some help to everyone. If you still have a lot of doubts to be solved, you can follow the industry information channel for more related knowledge.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.