title: How to prevent tomcat session hijacking?
body: <p>In my web.xml I've defined a user-data-constraint for some resources:</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Personal Area&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/personal/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;User Area&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/user/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;user-data-constraint&gt;
          &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
  &lt;/security-constraint&gt;
  </code></pre>
  
  <ol>
  <li>When I load the page with http I've got my JSESSIONID ID1 in my cookie. </li>
  <li>When I change to context/user/sample.faces then Tomcat makes a 302 redirect to HTTPS. But my JSESSIONID is still ID1.</li>
  </ol>
  
  <p>I think this is a vulnerability? Or is it my configuration mistake?</p>
  
  <p>The problem I see is the following: While browsing over HTTP with cookie ID1 there is an attacker who is listening to my network traffic. He "steals" my cookie ID1. Now I switch to HTTPS and my cookie is still ID1. I login. The attacker is then able to taker over my session because he knows my cookie...</p>