Shulou(Shulou.com)06/01 Report--

What is the session protection mechanism of SAP Cloud for Customer and Hybris Commerce? in order to solve this problem, this article introduces the corresponding analysis and solution in detail, hoping to help more partners who want to solve this problem to find a more simple and feasible way.

# Hybris

What is this HybrisSessionFixationProtectionStrategy?

Spring comes with a SessionFixationProtectionStrategy:

>

Session fixation attack (session fixed attack) uses the session invariant mechanism of the server to obtain authentication and authorization with the help of others, and then impersonates others. Session fixing vulnerabilities often occur when an application establishes an anonymous session for each user the first time a user accesses it. Then, once the user logs in, the session is upgraded to an authenticated session. Initially, the session token is not given any access, but after the user is authenticated, the token also has access to that user.

To prevent session fixing attacks, you can recreate a session id after the user has successfully logged in and forcibly invalidate the anonymous session before login.

What Hybris does: inherit HybrisSessionFixationProtectionStrategy,override and onAuthentication:

The session before line 135 is forced to expire.

The location of this implementation:

This is the answer to the question about what is the session protection mechanism of SAP Cloud for Customer and Hybris Commerce. I hope the above content can be of some help to you. If you still have a lot of doubts to be solved, you can follow the industry information channel for more related knowledge.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.