Secure Authentication and Session Management in Java EE
summary
Live demos show session IDs leaking in URLs, being sniffed with TCPdump, swapped into a browser with Cookie Manager, exfiltrated via XSS (document.cookie posted to an attacker servlet loaded as an image), and abused by CSRF hidden forms that transfer €666 into an attacker account. Recommendations include disabling URL rewriting (tracking-mode cookie), setting HttpOnly and secure flags, forcing new IDs after login (changeSessionId or invalidate/getSession), and beware Jetty’s short ~8–10 char IDs; use OWASP ZAP or proxies to test.
AI-written summary · about
chapters (9)
- 0:00Introduction to web security
- 3:35Session hijacking basics
- 8:04Demo: URL session exposure
- 13:13Demo: Hijacking via network
- 19:27Preventing transport leakage
- 23:44Demo: Stealing via XSS
- 31:21Defending against XSS
- 39:20Session fixation and security
- 45:24CSRF and final thoughts
related talks
52mSecure Authentication and Session Management in Java EE
50mSecure Authentication and Session Management
31mHow to Protect Yourself Against XSS Attacks in Java
42mSession Security in Web Applications
56mHow to avoid vulnerabilities and adopt security best practices?
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application
01h 04mWeb Security And You
52mDon't Get Burned! Secure Coding Essentials in Java to protect your application.