search

eclipse-ee4j / mojarra

Mojarra, a Jakarta Faces implementation
Other
158 stars 107 forks source link

The jfwid contains the session ID #5375

Closed jasondlee closed 4 months ago

jasondlee commented 6 months ago

The client window ID generated in ClientWindowImpl contains the session ID, which is not needed for this functionality, and exposure of the session ID can be used to compromise security. This method should be modified, then, so as not to use the session. PR incoming.

arjantijms commented 6 months ago

+1 indeed for not leaking the session ID anyway, and even more so when it's not needed.