Session cookie name parameter

getodk / aggregate

ODK Aggregate is a Java server that stores, analyzes, and presents survey data collected using ODK Collect. Contribute and make the world a better place! ✨🗄✨

https://docs.opendatakit.org/aggregate-intro/

Other

74 stars 227 forks source link

Session cookie name parameter #503

Closed ChakshuGautam closed 3 years ago

ChakshuGautam commented 3 years ago

In Context file there needs to be a parameter for cookie name similar to this otherwise it would always default to JSESSIONID.

A sample would be <Context useHttpOnly="false" sessionCookieName="JSID">

Background Context: A security agency asked us to change the cookie name as a fix for (Session ID Name Fingerprinting)[https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-id-name-fingerprinting]

lognaturel commented 3 years ago

Thanks for filing this. As the report describes, the risk presented by using the default name is that it leaks what technologies that a server is built on. However, this is not relevant for an open source application such as ODK Aggregate -- the whole source code is available right here so it's trivial to find what technology it uses.