session id security issues
The most common way is to manage the session id yourself
1. After the user logs in, an accessToken is encrypted in the background and returned to the user.
2. When the client receives the accessToken, it can be stored. In the case of the web, it can be stored in session storage, and the mobile phone can also save the accessToken for single sign-on.
3. At the same time, the server will save a copy of accessToken related information on the server, such as: deviceId, IP, accessToken, loginTime, logoutTime, userId, userAgent, etc.
3. Each time the API is requested, the accessToken will be submitted to the server, and the server will compare the accessToken to see if it is correct or not. If it is successful, the service will be executed.
With Spring Security (suitable for CMS)
1. The session id is created by Spring Security.
2. Then send it to the client and save it in the browser's cookie.
3. Each request sends the cookie to the server, then checks for correctness and timeout.
4. This method needs to set httponly and secure in Tomcat. (Prevent XSS attack)
HttpOnly：
If the "HttpOnly" attribute is set in the cookie, the program (JS script, Applet, etc.) will not be able to read the cookie information, which can effectively prevent XSS attacks.
Configuration:
Find context.xml under tomcat/conf/ and modify <Context useHttpOnly="true">
secure
When set to true, it means that the created cookie will be transmitted to the server in a secure form, that is, it can only be passed by the browser to the server in an HTTPS connection for session verification. If it is an HTTP connection, this information will not be transmitted. Therefore, the specific content of the cookie will not be stolen.
Configuration: (generally used with HTTPS certificates)
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="/usr/local/tomcat7/server.keystore"
keystorePass="Envisi0n" />
This content is reproduced, source blog address: http://youyu4.iteye.com/blog/2335405