Project

General

Profile

Actions

Improvements #11049

open
RS RM

Mitigate issues that may arise from changing the session id

Improvements #11049: Mitigate issues that may arise from changing the session id

Added by Roel Standaert almost 4 years ago. Updated about 2 months ago.

Status:
Resolved
Priority:
Normal
Target version:
Start date:
11/07/2022
Due date:
% Done:

0%

Estimated time:

Description

One major downside to the fact that session ids may change (e.g. when logging in, to mitigate session fixation attacks) is that it can cause issues with functions that expect the session id to stay the same, like WServer::post.

We should find a way to fix this, e.g. by adding a session token that changes, which should be provided in the wtd parameter (or in an additional parameter), while the session id stays the same for use in functions like WServer::post.


Related issues 1 (1 open0 closed)

Related to Feature #11036: Thread safe smart (weak) pointer for WApplicationNew10/31/2022

Actions

RS Updated by Roel Standaert almost 4 years ago Actions #1

  • Related to Feature #11036: Thread safe smart (weak) pointer for WApplication added

RM Updated by Romain Mardulyn over 1 year ago Actions #2

  • Status changed from New to InProgress
  • Assignee set to Romain Mardulyn

RM Updated by Romain Mardulyn over 1 year ago Actions #3

  • Status changed from InProgress to Review
  • Assignee deleted (Romain Mardulyn)

RM Updated by Romain Mardulyn 2 months ago Actions #4

  • Target version changed from future to 4.15.0

ED Updated by emil de keyser 2 months ago Actions #5

  • Assignee set to emil de keyser

ED Updated by emil de keyser about 2 months ago Actions #6

  • Status changed from Review to Resolved
  • Assignee changed from emil de keyser to Romain Mardulyn
Actions

Also available in: PDF Atom