0

As we know Spring Security is providing JSESSIONID in cookie, based session management solution,it is allowing sharing same JSESSIONID information across multiple tabs of same browser.

As per OWASP guideline, It should not share.

Is there any way to disable this sharing in spring security?

Ketan
  • 2,612
  • 5
  • 31
  • 44

1 Answers1

1

My first idea was "It is not really possible to prevent the browser from doing so."

But then I found this

You can use HTML5 SessionStorage (window.sessionStorage). You will generate a random id and save in session Storage per Browser Tab. Then each browser tab has his own Id. https://stackoverflow.com/a/11783754/280244

I hope this helps you to find a solution.

Community
  • 1
  • 1
Ralph
  • 118,862
  • 56
  • 287
  • 383