SNarkhede (Community Member) asked a question.
CWE 384 session fixation
We are getting Session Fixation CWE ID 384 flaw for below piece of code, we tried multiple solution available on network but unable to fix this problem, getting this flaw in below code
synchronized (request.getSession()) {
request.getSession().setAttribute(abc,xyz);
}.
Another thing is as per design restriction we can’t invalidate existing session and recreate new one
Please share possible solution.
.png){kind=logo}
Hi @SNarkhede (Community Member) ,
Veracode Static Analysis will report a flaw of CWE 384 Session Fixation if it can see that the session is accessed but never invalidated (see also: https://docs.oracle.com/cd/E19146-01/819-2634/abxdj/index.html ).
I would recommend reviewing the OWASP Session Management Cheat Sheet, especially on renewing after a privilege level change ( https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#renew-the-session-id-after-any-privilege-level-change ) and Manual Session Expiration ( https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#manual-session-expiration ).
If the session management occurs in a different application you can document this using a mitigation proposal ( https://help.veracode.com/r/improve_mitigation ) and contact your organizations security team for review.
Thank you,
Boy Baukema