Re: Can a session created in a secured domain be detected in a non-secured domain?

From:

Daniel Pitts <newsgroup.nospam@virtualinfinity.net>

Newsgroups:

comp.lang.java.help

Date:

Mon, 12 Aug 2013 10:16:27 -0700

Message-ID:

<zL8Ot.153720$726.18885@fx06.iad>

On 8/12/13 9:23 AM, isuy wrote:

Hi, I am writing a shopping cart using Java servlet and I have a question.

Let say I have a servlet "MyAccount" in 8443 port which is secured. I
created a session there, but session.getSession(false) from other
program in 8080 port which is not secured returns null.

Is this the way it is or is it that I am doing something wrong?

Thank you for your time.

Sessions are often correlated by cookie. For security, that cookie
should never be sent "in the clear" or in plain-text, and therefor
should always be sent via https.

If you need to present information to a user which is in a secure
session, then the request should be https. You may be able to do this
via AJAX, if only part of your page needs to be https.

Depending on the scale of your site, though, it may be better to do the
whole page https when the user has a session.

There are probably other work-arounds, but they may compromise security
unless implemented by a web-based software security professional.