10.7 Turn off session facade recycling

Information

The RECYCLE_FACADES can specify if a new facade will be created for each request. If a new facade is not created there is a potential for information leakage from a prior session.

Rationale:

When RECYCLE_FACADES is set to false, Tomcat will recycle the session facade between requests which may result in information leakage.

Solution

To start Tomcat with RECYCLE_FACADES set to true, add Dorg.apache.catalina.connector.RECYCLE_FACADES=true to your startup script.

Default Value:

The default value is false.

References:

https://tomcat.apache.org/tomcat-8.0-doc/config/systemprops.html

https://tomcat.apache.org/tomcat-8.0-doc/security-howto.html

See Also

https://workbench.cisecurity.org/files/2506

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv6|3.1, CSCv7|5.1

Plugin: Unix

Control ID: 9ed06df0ebbbe753fc26af386b5079b4206765b2b09f798517168ce6c4435317