Sensitive Value Passed In URL

[khoward]

We are using SmartGWT Power 6.0 with Realtime Messaging. While doing security tests we found that possibly sensitive values were being passed in URL requests. Specifically the session
cookie was being sent. For example, the URL is

[FONT=arial, helvetica, sans-serif]Request URL:[/FONT]
[FONT=arial, helvetica, sans-serif]http://.../sc/messaging?ts=1494265095122&isc_noLog=1&type=connect&connectionID=isc_HiddenFrame_0&subscribedChannels=%7B%0A%20%20%20%20%2235CEB310FD9249E360FD10C8AADBBFED%22%3A%7B%0A%20%20%20%20%20%20%20%20subscriptionCallback%3Anull%0A%20%20%20%20%7D%0A%7D&eventStream=true[/FONT]


[FONT=arial, helvetica, sans-serif]and the request header contains:[/FONT]

[FONT=arial, helvetica, sans-serif]Cookie:[/FONT]
[FONT=arial, helvetica, sans-serif]JSESSIONID=35CEB310FD9249E360FD10C8AADBBFED[/FONT]


Is there anything that can be done to prevent this?

Thanks,
Ken

[Isomorphic]

The session cookie is normally passed with every HTTP request as a cookie value, and sometimes as a URL parameter. Why do you consider this value "sensitive"?

[khoward]

According to our security team:

Information sent in the URL may be exposed in the web server or proxy logs.
Additionally, some browsers store URLs and their parameters in the browsers history,
cache, or bookmarks, even when accessed over HTTPS. If an attacker can gain access
to the session value, they may be able to hijack the user’s session.

[Isomorphic]

That would be a generic message output from a security scanner. Such tools produce many spurious reports of vulnerabilities which are not actually exploitable. Unless your security team can articulate an actual approach to exploiting this, it's not one to worry about.

Oh also, it appears to be your application code, not the framework, which is putting the sessionId into this particular URL. It appears to be used as part of the name of a subscribed channel, presumably to keep them unique. But again, this is a valid technique.

[khoward]

Makes sense.

Thank you very much.