Secure Session Wizard

Purpose

You can start this application-specific wizard on the Wizards tab when you’ve selected an application in the navigation area.

Sessions form a fundamental part of virtually all web applications. Sessions are usually implemented using a session cookie.

vWAF assists in implementing sessions so that a potential attacker can’t operate any session hijacking. To do this, vWAF establishes a separate, secure HTTP session to the user’s browser and generates a separate, cryptographically secure session cookie (you can configure the name of this cookie in Global Configuration).

In addition, vWAF also saves all other cookies of the web application and re- inserts them for the next request. The cookies generated by the web application are therefore no longer transmitted to the browser and can no longer be manipulated by an attacker.

For more information regarding Wizards, see Using Wizards to Configure Applications.

Attributes

Handlers configured by the Secure Session Wizard

The Secure Session Wizard configures the following handlers:

• Cookie Jar Handler
• Session Handler
• Valid Request Handler