title: Cross Site History Manipulation(Checkmarx)
body: <p>Does anyone know how to fix the Checkmarx vulnerability -- Cross Site History Manipulation for java based applcations? 
  Here is the description provided by Checkmarx scan -- "the method may leak server-side conditional values, enabling user tracking from another website. This may constitute a Privacy Violation."</p>
  
  <p>Here is the related code :</p>
  
  <pre><code>if(user is logged in) {
       response.sendRedirect(url);
  } else {
       response.sendRedirect(url)
  }
  </code></pre>
  
  <p>Upon googling I found some Checkmarx documentation which to suggest to add a  random number to the redirect url. Here is the link to the document : <a href="https://www.checkmarx.com/wp-content/uploads/2012/07/XSHM-Cross-site-history-manipulation.pdf" rel="nofollow noreferrer">https://www.checkmarx.com/wp-content/uploads/2012/07/XSHM-Cross-site-history-manipulation.pdf</a></p>
  
  <p>For e.g :</p>
  
  <pre><code>If ( !isAuthenticated)
    Redirect(„Login.aspx?r=‟ + Random())
  </code></pre>
  
  <p>I tried this approach but the Checkmarx scan still show the same vulnerability.Not sure why. </p>