Session Cheat

[Per Jørgen Vigdal]

Hi.

This is maybe not directly a shibboleth related issue, but how can I prevent session manipulation ?
Ref. https://www.owasp.org/index.php/Session_Management_Cheat_Sheet
Does anyone know a good approache?  Is it possible to correlate the JSESSION cookie and the shibstate cookie.
My shibboleth protected recourse is a java servlet.

-Per Jørgen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151124/f1335812/attachment.html>