Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.help > #2750 > unrolled thread

Can a session created in a secured domain be detected in a non-secured domain?

Back to article view | Back to comp.lang.java.help

Contents

  Can a session created in a secured domain be detected in a non-secured domain? isuy <isuy@socal.rr.com> - 2013-08-12 09:23 -0700
    Re: Can a session created in a secured domain be detected in a non-secured domain? Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2013-08-12 10:16 -0700

#2750 — Can a session created in a secured domain be detected in a non-secured domain?

Hi, I am writing a shopping cart using Java servlet and I have a question.

Let say I have a servlet "MyAccount" in 8443 port which is secured. I 
created a session there, but session.getSession(false) from other 
program in 8080 port which is not secured returns null.

Is this the way it is or is it that I am doing something wrong?


Thank you for your time.

[toc] | [next] | [standalone]

#2751

On 8/12/13 9:23 AM, isuy wrote:
> Hi, I am writing a shopping cart using Java servlet and I have a question.
>
> Let say I have a servlet "MyAccount" in 8443 port which is secured. I
> created a session there, but session.getSession(false) from other
> program in 8080 port which is not secured returns null.
>
> Is this the way it is or is it that I am doing something wrong?
>
>
> Thank you for your time.
Sessions are often correlated by cookie. For security, that cookie 
should never be sent "in the clear" or in plain-text, and therefor 
should always be sent via https.

If you need to present information to a user which is in a secure 
session, then the request should be https.  You may be able to do this 
via AJAX, if only part of your page needs to be https.

Depending on the scale of your site, though, it may be better to do the 
whole page https when the user has a session.

There are probably other work-arounds, but they may compromise security 
unless implemented by a web-based software security professional.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.java.help

csiph-web