Contents
V5316. Do not use the 'HttpServletRequest.getRequestedSessionId' method because it uses a session ID provided by a client.
The analyzer has detected the use of HttpServletRequest.getRequestedSessionId method in the application. This method is not recommended for use.
Vulnerabilities related to the use of this method can be categorized under the OWASP Top 10 2021 as follows:
Look at the following example:
boolean validate(HttpServletRequest request) {
var sessionId = request.getRequestedSessionId();
// ....
}When analyzing the code fragment, the analyzer will warn that the use of getRequestedSessionId is not recommended as it is likely to be incorrect.
The issue lies in the fact that getRequestedSessionId returns the ID specified by the client. As stated in the Jakarta JavaDoc:
This may not be the same as the ID of the current valid session for this request.
To obtain the current ID, use the following option:
boolean validate(HttpServletRequest request) {
var sessionId = request.getSession().getId();
// ....
}The same Jakarta JavaDoc states that getSession returns the requested session or creates a new one:
Returns the current session associated with this request, or if the request does not have a session, creates one.
In this way, the correct session ID is obtained.
Was this page helpful?
