title: OWASP Application Security Verification Standard - V3 and using with JSF
body: <p>At the moment I'm dealing with implementing everything is to be safe against the security risks of the <a href="https://www.owasp.org/index.php/Category%3aOWASP_Top_Ten_Project" rel="nofollow">Top 10 Project</a><br>
  For #4 of the Top 10 - <a href="https://www.owasp.org/index.php/Top_10_2010-A3" rel="nofollow">Insecure Direct Object References</a> the OWASP refers to the <a href="https://www.owasp.org/index.php/Category%3aOWASP_Application_Security_Verification_Standard_Project" rel="nofollow">OWASP Application Security Verification Standard</a></p>
  
  <p>So I was reading all the suff in <a href="http://code.google.com/p/owasp-asvs/wiki/Verification_V3" rel="nofollow">V3</a>, but I have now some questions implementing it.<br>
  I'm using JBoss-AS 7.0.1 with Java EE6 and JSF 2.0</p>
  
  <blockquote>
    <p>V3.4 Verify that the session id is never disclosed other than in cookie headers; particularly in URLs, error messages, or logs. This includes verifying that the application does not support URL rewriting of session cookies.</p>
  </blockquote>
  
  <p>I read some articles here on stackoverflow how to avoid that the jesssion is in the URL for the first time a user is visiting the side...
  But many answers are like: use the URL rewriting ... what does this means in contrast to the <code>does not support URL rewriting of session cookies</code></p>
  
  <p>What is the normal way to deal with jsessions on the first entry? What is a save way to handle it?</p>
  
  <blockquote>
    <p>V3.10: Verify that only session ids generated by the application framework are recognized as valid by the application.</p>
  </blockquote>
  
  <p>How you do this in JSF2.0 / JavaEE?</p>
  
  <blockquote>
    <p>V3.12: Verify that cookies which contain authenticated session tokens/ids have their domain and path set to an appropriately restrictive value for that site.  </p>
  </blockquote>
  
  <p>What does this mean? When i look with my Firebug into the the cookie, I run the webapp from the URL <a href="http://localhost:8080/projectname/" rel="nofollow">http://localhost:8080/projectname/</a><br>
  and in the cookie i get: Path: /projectname<br>
  is this what the OWASP means with <code>have their domain and path set to an appropriately restrictive value for that site.</code> ?</p>
  
  <p>Thank you!</p>