topic Strange behaviour with JSESSIONID creating Session Fixation issue in Alfresco Forum

Strange behaviour with JSESSIONID creating Session Fixation issue

hiten_rastogi1 — Thu, 10 May 2018 10:21:58 GMT

Hi,After adding an OOTB evaluator group.module.evaluator in my extension module for hiding Create Site option for non admin user, which BTW works fine, I can see that there is a change in the way JSESSIONID is created.In normal standalone share project JSESSIONID is created when the user logs in and

Re: Strange behaviour with JSESSIONID creating Session Fixation issue

afaust — Fri, 11 May 2018 08:24:53 GMT

Create an issue in the Alfresco JIRA and maybe even a pull request on the Alfresco Surf project to make the login controller always create a new session as part of the login (currently it only creates a new session if the old session contains a specific attribute to denote an already authenticated user).

Re: Strange behaviour with JSESSIONID creating Session Fixation issue

hiten_rastogi1 — Fri, 11 May 2018 08:40:27 GMT

Thanks Axel,

I have created an issue.

https://issues.alfresco.com/jira/browse/AIF-430

Re: Strange behaviour with JSESSIONID creating Session Fixation issue

afaust — Fri, 11 May 2018 15:25:49 GMT

NEVER create an issue in any project other then ALF unless you are absolutely sure it is the right one. The project you have chosen has nothing to do with Share...