Re: [Dev] Session fixation with Application Server 6.0.0 SAML 2.0 single-sign-on

Hi all, sure I follow that procedure in the future. On Tue, Jun 21, 2016 at 7:21 PM, Prabath Siriwardana wrote: > Hi Chiranga, > > On Tue, Jun 21, 2016 at 6:02 AM, Chiranga Alwis wrote: > >> Hi all, >> >> during the code review held last Friday, there was

Re: [Dev] Session fixation with Application Server 6.0.0 SAML 2.0 single-sign-on

Hi Chiranga, On Tue, Jun 21, 2016 at 6:02 AM, Chiranga Alwis wrote: > Hi all, > > during the code review held last Friday, there was a discussion on session > fixation. > > I performed a minor research on session fixation and checked out on > measures taken by Tomcat

[Dev] Session fixation with Application Server 6.0.0 SAML 2.0 single-sign-on

Hi all, during the code review held last Friday, there was a discussion on session fixation. I performed a minor research on session fixation and checked out on measures taken by Tomcat internally to prevent such attacks. From what I have discovered it seems that Tomcat provides session fixation