312-96: Certified Application Security Engineer (Java)

Question

Which of the following Spring Security Framework configuration settings ensures protection against session-fixation attacks by not allowing an authenticated user to log in again?

Explanation

migrateSession protects against session fixation by creating a new session upon authentication and copying the existing session attributes to that new session. The pre-authentication session identifier is therefore not retained as the authenticated session.

Learn more

Spring Security Reference: Authentication Persistence and Session Management

312-96: Certified Application Security Engineer (Java)

AstroTutor

Notes

Readiness

QuestionQ3

Community Discussion