Security problem? Bounded taskflow and sessionid in loopback url

Question

Hi,
We just had a security evaluation of our public site. We use ADF in several places on the site (through iframes).
The applications are made up of bounded taskflows. The request Url reads like:
http://127.0.0.1:7101/test/faces/adf.task-flow?adf.tfId=task-flow-definition&adf.tfDoc=/WEB-INF/task-flow-definition.xml
and it returns :
http://127.0.0.1:7101/test/faces/adf.task-flow;jsessionid=R9YWRvkLJyD6lYC79DyTmTl6fxj177x1ZflDcJy4mrlcYmDVSmn0!-1545839156?adf.tfId=task-flow-definition&adf.tfDoc=/WEB-INF/task-flow-definition.xml&_afrLoop=97476727347664&_afrWindowMode=0&_afrWindowId=null
According to the security evaluation the ;jsessionid=xxx in the header is a security problem, you could in principle copy the url and send it to a different computer and continue the session from there!
The jsessionid is put there by the loop back script.
Is there any way of making the loop back script not put the jsessionid in the url?
Is it a security problem?
regards
Johnny

Answer 1

Hi, thank you for the opinion. I am not talking about hijacking my own session id. But "malware" or a spy in som way could "sniff" the url and send it off to another computer!
Look at this url, it explains it even better :
http://fralef.org/tomcat-disable-jsessionid-in-url.html
Again it is not my opinion but that of a security firm.
Cookies are not disabled on my computer ( and our security firms), the case is real and how bounded taskflows work.
Here is the code from the loop back:
var sess = ";jsessionid=TdJhRvVGHnYZtTfzsMBpmDcSnLVHW0SzgBWl0gQm2tPQ45lwsq1W!-1545839156";
if (sess.length > 0)
href += sess;
After the redirect the cookies "takes" over and the jsession id is not shown again.
But it is still shown initially.
And we do use https on our site, my code was just an illustration.
Johnny
Edited by: user11345344 on Feb 28, 2013 8:44 PM