What prevents HttpSession's id from being stolen?

Question

In the Java Servlet API, what is done to ensure that someone's session id is not stolen?

For example, if I had an active session and someone somehow get a hold of my session id, could they use it?

Answer 1

Nothing prevents it. You get the session ID, you can take part in the session.

In the usual case of cookies this is not a risk in itself. The attacker should not be able to read a user's session cookie unless:

1. they've got man-in-the-middle capability, in which case you've got much worse problems than just session IDs;

2. you've left a cross-site-scripting hole, in which case you've got much worse problems than just session IDs;

3. you're vulnerable to DNS-rebinding/cross-domain-cooking attacks, in which case you should fix it by only allowing known-good Host: requests.

(Whilst you can try tying sessions to IP addresses, this risks breaking valid sessions due to eg round-robin proxies. IPs can be used as part of a wider strategy for detecting suspicious activity, but on the public internet it's not a good idea always to require each request in a session to come from the same IP.)

Unfortunately in Servlet there is another case, apart from cookies: jsessionid= parameters. Since they appear in the URL itself, that makes them much more leaky (eg via referrers and pasted links). And that's far from the only practical problem with parameter session IDs. They mess up navigation and wreck SEO.

In my opinion jsessionid= URLs are one of Servlet's worst early mistakes, a discredited cookie fallback strategy from yesteryear that shouldn't be used for anything. But certainly they shouldn't be allowed to grant access to any privileged data; consider using HTTP Basic Authentication instead if you need a fallback mechanism for browsers that don't support cookies.

In Servlet 3.0 you can disable jsessionid= URLs easily using <session-config> in the web.xml; unfortunately in previous versions you are left mucking around with filters if you want to properly disable the feature.