Proactively invalidate inactive sessions [New in Security Center 1.3 and updated in 1.5]
The glide.active.session.timeout.invalidate.session property controls if a timeout session is proactively invalidated before the Tomcat server.
When glide.active.session.timeout.invalidate.session is not set to true, there can be a small interval of time where a timed out session is not invalidated (60 or more seconds depending on queue size). If a session is hijacked, an attacker may be able to use a session during this small period of time. To remediate this security risk, set glide.active.session.timeout.invalidate.session to true.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.active.session.timeout.invalidate.session |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | boolean |
| Recommended value | true |
| Default value | false |
| Category | Session management |
| Security risk |
|
| Dependencies and prerequisites | None |