title: Session hijacking in Java Spring
body: <p>I have a question regarding hijacking session variables. Let us suppose we have a web app supported by Spring Security and I have landed on a page with a bunch of session variables stored on the server side. Now, session variables normally are not accessible purely from the client side. Is there any way for the client to somehow get the page re-directed to another web app (with malicious server-side scripts) while keeping the current session variables intact?</p>
  
  <p>My impression is that it is not possible without significant flaws in the original web app.</p>
  
  <p>Anyhow, the question is: Is it possible to steal session variables of web apps supported by Spring Security without making any changes to the server side content of the web app?</p>
  
  <p>Edit: Using TLS</p>