10.7 Turn off session facade recycling

Information

The RECYCLE_FACADES can specify if a new facade will be created for each request. If a new facade is not created there is a potential for information leakage from other sessions.

Rationale:

When RECYCLE_FACADES is set to false, Tomcat will recycle the session facade between requests which may result in information leakage.

Solution

Start Tomcat with RECYCLE_FACADES set to true. Add -Dorg.apache.catalina.connector.RECYCLE_FACADES=true to your startup script.

Default Value:

The default value is false.

See Also

https://workbench.cisecurity.org/files/4103