Re: post to bugtraq about "session fixation"

On Wednesday 18 December 2002 15:18, Kevin Spett wrote:
> If the session management implementations of web application servers

Perhaps, but there are a lot of other requisite mistakes needed for this to be an issue, such as:

• the app must accept the SAME session IDs across both secured and unsecured interactions
• the app must not change the session id on a per-page or per-action basis
• the app must not issue another "action specific" nonce to be used in conjunction with the session ID to validate for sensitive actions

> Lots of people rely on the

I agree. For sites that have the multitue of problems necessaray to exploit this, it's a serious issue.

> Sure,

My favorite claim in that flash marketing trainwreck: "Active scout blocks all attacks, even the unknown ones". And we wonder why people find it hard to trust security vendors...sigh...

-- 
Alex Russell
alex@netWindows.org
alex@SecurePipe.com