Does the Play! framework have any built in mechanism to prevent session hijacking?

Question

I've read that the play framework solves the session fixation issue by hashing the session id with the application key, but does it provide any mechanism to prevent session hijacking, or is this left up to the implementor?

Answer 1

The play documentation has a good section on security, so rather than duplicate, here is a link - http://www.playframework.org/documentation/1.2.4/security.

It covers

• XSS
• SQL Injection
• Session security
• Cross site request forgery

Some you have to implement yourself, others you don't.

Your specific question about session hijacking is automatic.

The session is a hash of key/values, signed but not encrypted. That means that as long as your secret is safe, it is not possible for a third-party to forge sessions.