10.7 Turn off session facade recycling

Information

The RECYCLE_FACADES can specify if a new facade will be created for each request. If a new facade is not created there is a potential for information leakage from other sessions.

Rationale:

When RECYCLE_FACADES is set to false, Tomcat will recycle the session facade between requests which may result in information leakage.

Solution

Start Tomcat with RECYCLE_FACADES set to true. Add -Dorg.apache.catalina.connector.RECYCLE_FACADES=true to your startup script.

Default Value:

The default value is false.

See Also

https://workbench.cisecurity.org/benchmarks/11652

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|5.1

Plugin: Unix

Control ID: ebcc1b944910b158dd4cedd3c7a5eb2f1feaca109cbfb9034d357df473333a2d