Oracle Weblogic Server (MOSC)

MOSC Banner

Recreating Session ID after user authentication to avoid Session Fixation Attacks

edited Aug 25, 2011 1:01AM in Oracle Weblogic Server (MOSC) 7 commentsAnswered
After user authenticates I want to change the session id so that the application is secured from session fixation attacks. I have checked ATG community and found some references where the solution is given as to invalidate the session and recreate a new session. But my doubt is if we do so will the data already stored in session such as shoppping cart, locale preference etc. will be lost or retained into new session by the app server(I am using weblogic 10)? Also want to know if session invalidation has any side effects on memory management doen by the application

Howdy, Stranger!

Log In

To view full details, sign in to My Oracle Support Community.

Register

Don't have a My Oracle Support Community account? Click here to get started.

Category Leaderboard

Top contributors this month

New to My Oracle Support Community? Visit our Welcome Center

MOSC Help Center