Session Fixation with Axon.ivy

Bao Tran — Wed, 03 Jan 2018 04:25:25 -0500

Hi everyone, as far as I can find, every time user logs in with IVY Portal, the session is kept (not renewed). You can check this via JSESSIONID. Thus, it leads to session fixation attack.
May Axon.ivy provide a mechanism to prevent this kind of attack? I am using Axon.ivy 6.3.0.
Thank you.

Questions Tagged With jsf

Session Fixation with Axon.ivy