Using same Jsession ID to login into other machine

Question

In our project we are using weblogic server.

If I try to login into our application i.e on machine A, a JsessionId is generated after I logged in.

Now, if I use this same JsessionId on another machine i.e machine B the application will prompt me to home page instead of login page.

Please provide a solution for my problem.

Answer 1

Unless otherwise configured, most servers will destroy any JSessionID it does not recognize and issue a new one. This is to prevent Session Fixation attacks. Java Servlet Engines like Tomcat and Jetty do so as will various j2EE Application Servers such as WildFly(UnderTow) and WebLogic.

If you want to have a session migration between servers nodes you will need to configure your server to do so. Servlet Engines and Application Servers will not do so automatically. You will need to look at your Weblogic docs for your version of your Application Server to determine how to do it.

I will tell you that Wildfly and Tomcat definitely require multicast-ip to make this work. Depending upon your environment it is possible that multicast-ip is blocked by firewalls. Additionally I know, as of this writing, that docker containers do not support multicast-ip out of the box so you will need some sort of work-around if you are using docker containers.

The important thing is that you understand why the session is not automatically migrated and that you need to configure your server to do so. If Weblogic uses multicast-ip that might be another hurdle to overcome.

I hope this helps. This is as specific as I can be as I am not a Weblogic developer.

Answer 2

What you have stated is called session hijacking. There are many good answers on how to prevent it.

Prevent session from being replicated when JSESSIONID cookie copied

What is the best way to prevent session hijacking?

HTTP being an stateless protocol uses a session identifier (mostly a cookie) which is sent with every request which to identify the client. The most common way is to use HTTPS to encrypt your request and prevent anyone in the middle from seeing that session identifier.

One important point to consider is that if the attacker has physical access to your machine, then he/she can easily see your session identifier and there is nothing you can do about it. That's the reason why websites like facebook warn you when you open the browser console and run some scripts.