Rotate HTTP session identifiers
Use the glide.ui.rotate_sessions property to enable rotation of the HTTP session identifiers to reduce security vulnerabilities.
If the glide.ui.rotate_sessions system property is not set to the recommended value of true, then identifying information on a session is kept and not rotated between applications.
Ensure that the property glide.ui.rotate_sessions is set to true.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.ui.rotate_sessions |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | true |
| Default value | <none> |
| Fallback value | true |
| Category | Session management |
| Security risk | - Severity score: 8.8 - CVSS rating: High - Security risk details: This increases the risk of session hijacking, as attackers could reuse session identifiers to gain unauthorized access. |
| Functional impact | This remediation modified the SessionID when user navigates from unauthenticated page to authenticated pages. - If you are using a proxy or hardcoding the SessionID when a user first logs in, or for any purpose, then there can be a potential functionality impact. - If you are using the SAML 2.0 plugin for Single Sign-on authentication, it might interfere with the session information sharing between the instance and the Identity Provider. In such case, you can set this property to false. |
| Dependencies and prerequisites | None |
Parent Topic:Session management