sun access manager, session not cleaned issue. Identity theft and impersonisation.
A high-security risk, leading to identity theft and impersonation. This security issue is mostly caused by lack of knowledge of security aspects on part of application developers/ architects. PROBLEM One person signs into a sun access manager policy-enabled application from a web browser. After completing his task, he signs out and goes home relieved of his/ her work. But this machine is in public access, say some kiosk or cyber cafe. Another user comes in and signs into the same application which the previous user used. Viola....he logs into an application as the first person instead. CAUSE Sun access manager is responsible for deleting cookies of the application, which stores session and may store some other credentials too. Now one can only delete the cookies that belong to it. So in case, Sun access manager agent resides in www.xyz.com domain (see the site URL in the address bar for respective sites), it cannot delete cookies from another application from www.abc.com ...