Question

I have a web application in which we use JSF framework.
I have been diving deep into the security part for web application and hence I was looking to generate my own unique session ID(using encryption algorithm and assign it to every new session which gets created once user logs in.

Can anyone please guide me on how to set manual generated session id in session and ensure with each request that session id is transmitted.

Thanks.

Answer 1

I really doubt you’ll generate session IDs that are more secure than the ones generated by the container, but here’s what you could do, without using any container-specific extension.

Create a servlet filter which intercept every request to the server.

When a request comes in, check if a session already exists for this request (using getSession(false)). If one exists, then extract your specific cookie MY_SESSION_ID from the request, and compare its value to the one that is stored in the session. If they don’t match, reject the request.

If the session doesn’t exist, then create it (using getSession(true)), generate your super-secure session ID, store it as a session attribute and add the cookie MY_SESSION_ID to the response.

This has the disadvantage of creating a session automatically, even if it’s not strictly needed. But that’s the case most of the time when using JSPs of component frameworks.