Spring Security - Third Edition

Simulating a session fixation attack

At this point, you may want to see what's involved in simulating a session fixation attack:

1. You'll first need to disable session fixation protection in the SecurityConfig.java file by adding the sessionManagement() method as a child of the http element.

You should start with the code from chapter14.00-calendar.

Let's take a look at the following code snippet:

    //src/main/java/com/packtpub/springsecurity/configuration/    SecurityConfig.java    http.sessionManagement().sessionFixation().none();

Your code should now look like chapter14.01-calendar.

2. Next, you'll need to open two browsers. We'll initiate the session in Google Chrome, steal it from there, and our attacker will log in using the stolen session in ...