This week's book giveaways are in the Java EE and JavaScript forums.
We're giving away four copies each of The Java EE 7 Tutorial Volume 1 or Volume 2(winners choice) and jQuery UI in Action and have the authors on-line!
See this thread and this one for details.
The moose likes Servlets and the fly likes Session tampering Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login

Win a copy of The Java EE 7 Tutorial Volume 1 or Volume 2 this week in the Java EE forum
or jQuery UI in Action in the JavaScript forum!
JavaRanch » Java Forums » Java » Servlets
Bookmark "Session tampering" Watch "Session tampering" New topic

Session tampering

roel croonenberghs

Joined: May 28, 2009
Posts: 10

In my application, I have a JSESSIONID for access control. Now when I access my app with chrome as user 1 and take over the JSESSIONID and then go to firefox, login as user2 and alter the JSESSIONID to make the value the same as for user1. From there on I'm identified as user1.
I know one should have access to the app /computer user1 has used. And user1 must not be logged out (just closed browser) and no session timeout has occured. To be able to exploit this sessionid tampering.
But is there a way to prevent it? And knowing that the JSESSIONID is not valid.
Sagar Rohankar
Ranch Hand

Joined: Feb 19, 2008
Posts: 2902

Try to implement one of the "Prevention" listed here:

[LEARNING bLOG] | [Freelance Web Designer] | [and "Rohan" is part of my surname]
I agree. Here's the link:
subject: Session tampering