Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I received an error from the Security testing team as follows:

It was observed that same session value is used for different sessions. After logout, session value should be cleared and the user should be provided a new session value every time user logs in. It was observed that every time user login the session value was set to the following value "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

How to rectify this? What would be the best approach to avoid these kind of issues?

share|improve this question
    
The cookie that SharePoint gives users has a timeout. What authentication method are you using? –  Mike Nov 22 '11 at 15:22
    
Yes, normally it should timeout and probably the session value should be reset or changed I believe. The authentication method used is Windows. –  Deepu Nair Nov 22 '11 at 15:28
add comment

2 Answers

ASP.NET does not always give a unique session ID. If no data is written to the session, ASP.NET may reuse the ID.

Here is an article explaining this: http://weblogs.asp.net/bsimser/archive/2004/09/13/228713.aspx

I would advise working with the sec. team to try to get a replicable (simple) example of when this occurs to identify why the session Ids are being reused.

Check for trends such as web browser, time logged in etc.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.