https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy<p>Hi everyone, as far as I can find, every time user logs in with IVY Portal, the session is kept (not renewed). You can check this via <em>JSESSIONID</em>. Thus, it leads to <a href="https://www.owasp.org/index.php/Session_fixation">session fixation</a> attack.<br> May Axon.ivy provide a mechanism to prevent this kind of attack? I am using Axon.ivy 6.3.0.<br> Thank you.</p>enWed, 09 May 2018 01:34:35 -0400https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy/3261<p><strong>This issue has been fixed in ivy 7.1 and 7.0.4.</strong></p>Alex SuterWed, 09 May 2018 01:34:35 -0400https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy/3261https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy/3054<p>Hi </p> <p>This is a known issue. See <a href="https://jira.axonivy.com/jira/browse/XIVY-349">https://jira.axonivy.com/jira/browse/XIVY-349</a> Unfortunately, we cannot fix this issue without breaking RIA applications. However, we plan to drop RIA support in Axon.ivy 8. After that we can fix this issue.</p> <p>Regards Reto Weiss, Axon.ivy Support</p>Reto WeissThu, 04 Jan 2018 04:20:10 -0500https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy/3054