Spring Boot Misconfiguration: Unsafe value for session tracking - Vulnerability Database

Spring Boot Misconfiguration: Unsafe value for session tracking

Description

This Spring Boot application is configured to support session tracking through both cookies and URL rewriting. URL-based session tracking appends the session identifier (e.g., ;jsessionid=ABC123) directly to URLs, which automatically activates when clients have cookies disabled. This configuration creates an unnecessary security risk, as session identifiers should only be transmitted via secure HTTP-only cookies.

Remediation

Configure Spring Boot to use cookie-based session tracking exclusively by setting the server.servlet.session.tracking-modes property in your application properties file (application.properties or application.yml).

For application.properties:

server.servlet.session.tracking-modes=COOKIE

For application.yml:

server:
  servlet:
    session:
      tracking-modes: COOKIE

After making this change, restart the application to apply the configuration. Additionally, ensure that session cookies are configured with the HttpOnly and Secure flags to further protect against cross-site scripting (XSS) and man-in-the-middle attacks.