title: URL Rewriting vulnerability
body: <p>We modified our Session handling from cookie based to URL Rewriting. By doing this the session id gets transmitted as part of the URL. </p>
  
  <p>Now there is a vulnerability issue, where whoever uses this URL will be able to log in into the system.</p>
  
  <p>To resolve this issue we have done the following</p>
  
  <p>[1] A HTTP Session Listener has been created to maintain list of HTTP sessions. 
  Listener reacts on the events when session are created or destroyed.</p>
  
  <p>[2] A Session Filter has been created to verify HTTP Session and check its integrity against HTTP Request attributes
  Session will be invalidated in case Request attributes (identifying the client origin) do not match original attributes stored with session. (to block the session hijack attempt)</p>
  
  <p>However i think that this has a gap, when you are trying to access over a proxy etc. </p>
  
  <p>Is there any other effective solution for this?</p>
  
  <p>Also we cannot use third party libraries to resolve this because of the nature of the produce.</p>