Re: Hijacking URL Encoded Session IDs using Referer Logs

["Jeff Dafoe" <jeff () badtz-maru com>]

> Many (most?) application servers use URL encoded session IDs when the
> user has disabled cookies. Many users disable cookies as a security
> precaution. There should be an advisory on this so that application
> server vendors stop allowing URL encoded session IDs by default.

    If the sessions in a particular app are that easy to hijack then the
security issue is with that and not necessarily with the method used to
transmit the session id.  That is why the origin of a request must be
validated when a request is issued against a particular session and it is
also why sessions must be expired in a timely fashion.  I think we are
treading old territory here, stuff that was previously covered in past "poor
session handling" advisories and such.


Jeff