Hi,
After adding an OOTB evaluator group.module.evaluator in my extension module for hiding Create Site option for non admin user, which BTW works fine, I can see that there is a change in the way JSESSIONID is created.
In normal standalone share project JSESSIONID is created when the user logs in and refreshes on every login but after adding the above evaluator I can see the JSESSIONID is getting created the moment I hit the login page and it stays there even after the login but refreshes on every logout.
I did some digging into the Alfresco code for the evaluator bean and found out that isMemberOfGroups method of the SlingshotEvaluatorUtil class called from the SlingshotGroupModuleEvaluator class creates a session for storing the GROUP membership in the session.
Now this behaviour creates a Session Fixation issue that permits an attacker to hijack a valid user session.
Can anyone please suggest what can be done here ??
Thanks
Hiten Rastogi
Create an issue in the Alfresco JIRA and maybe even a pull request on the Alfresco Surf project to make the login controller always create a new session as part of the login (currently it only creates a new session if the old session contains a specific attribute to denote an already authenticated user).
NEVER create an issue in any project other then ALF unless you are absolutely sure it is the right one. The project you have chosen has nothing to do with Share...
Ask for and offer help to other Alfresco Content Services Users and members of the Alfresco team.
Related links:
By using this site, you are agreeing to allow us to collect and use cookies as outlined in Alfresco’s Cookie Statement and Terms of Use (and you have a legitimate interest in Alfresco and our products, authorizing us to contact you in such methods). If you are not ok with these terms, please do not use this website.