I have a web application written in java. We don't use sessions in authentication process. An application scan was ran and it was found that we have possibility of session fixation attack. I am wondering when we are not using session, how do you fix or prevent session fixation? This is what the FORTIFY scan report tells
The following changes were applied to the original request:
• Added parameter 'Cookie_abcxyz.com-443' with the following value 'R3777273810'
• Removed cookie 'Cookie_abcxyz.com-443'
Request/Response:
GET / HTTP/1.1
Content-Length: 43
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: myportal.abcxyz.com
Cookie_abcxyz.com-443=R3777273810
HTTP/1.1 200 OK
Set-Cookie: Cookie_abcxyz.com-443=R3777273810; path=/
Content-Length: 11211
Date: Mon, 13 Feb 2012 17:08:14 GMT
Server: abcxyz
Cache-Control: no-cache
Content-type: text/html