« How-to Configure the ADF Faces Carousel Component with ADF | Main | Forum: ADF UI Patterns & Best Practices »
Heads-up: Required Security update for ADF Sample in Fusion Developer Documentation
By frank.nimphius | December 7, 2009
A code sample in section 30.7.2.1, “Creating Login Code for the Backing Bean” of the Fusion Developer’s Guide for Oracle ADF (part number B31974-04) needs to be updated to create a new sessionId for the session right after authentication, thus protecting applications against session fixation attacks. A simple code fix is to change the sample’s doLogin() method with an extra line after line 10 :
ServletAuthentication.runAs(mySubject, request);
ServletAuthentication.generateNewSessionID(request);
Note that the dcumentation is updated too and a new version is available on OTN. This blog entry is to ensure we reach all users that don’t read release note documentation on a regular basis.
See the updated documentation code here:
http://download.oracle.com/docs/cd/E15523_01/web.1111/b31974/adding_security.htm#BGBFJJJH
Frank
Topics: ADF, ADF Security | No Comments »
Comments are closed.
