問題

• The session spontaneously switches to another user
• The JSESSIONID cookie of the victim is set for the "perpetrator" leading to unintended session-stealing behavior

原因

Apache webserver, which proxies the Tomcat server, was configured to cache certain fixed-content files to relieve Tomcat of the traffic. The configuration does not use the CacheIgnoreHeaders directive to tell mod_cache not to cache "Set-Cookie" headers with the responses. In this situation it is possible for the cached item, with its Set-Cookie header, to be returned to another user resulting in the incorrect session being served.

ソリューション

If these problems are encountered, you can either:

• try disabling the mod_cache module completely, or
• invoke the directive CacheIgnoreHeaders Set-Cookie in Apache's mod_proxy configuration