1

I received an error from the Security testing team as follows:

It was observed that same session value is used for different sessions. After logout, session value should be cleared and the user should be provided a new session value every time user logs in. It was observed that every time user login the session value was set to the following value "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

How to rectify this? What would be the best approach to avoid these kind of issues?

  • The cookie that SharePoint gives users has a timeout. What authentication method are you using? – Mike Nov 22 '11 at 15:22
  • Yes, normally it should timeout and probably the session value should be reset or changed I believe. The authentication method used is Windows. – Deepu Nair Nov 22 '11 at 15:28
1

ASP.NET does not always give a unique session ID. If no data is written to the session, ASP.NET may reuse the ID.

Here is an article explaining this: http://weblogs.asp.net/bsimser/archive/2004/09/13/228713.aspx

I would advise working with the sec. team to try to get a replicable (simple) example of when this occurs to identify why the session Ids are being reused.

Check for trends such as web browser, time logged in etc.

0

Check this out : Setting the Login Token Expiration Correctly for SharePoint 2010 SAML Claims Users

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.