Contents
Advantages with cookies are that it is supported by default by Java EE containers, and does not have url breakage errors like that of URL rewriting. However a browser may disable cookies for security and privacy reasons, in which case, session management through cookies will not work.
What is URL rewriting attack?
URL Link Rewriting is a technique used by several email security companies to help in the fight against malicious links in emails. Proofpoint’s Targeted Attack Protection (TAP), Mimecast’s URL Protect, and Microsoft’s Safe Links all use similar forms of URL rewriting in their email filters.
How do I stop URL Defence?
URL Defense can be enabled or disabled on the Proofpoint Essentials portal: Navigate to Administration Section > Account Management > Features option. URL Defense is disabled by default.
What does URL defense do?
Proofpoint’s URL Defense (URL Re-Write) protects you and UT’s network resources by blocking access to malicious websites. Links in all email messages are evaluated using a variety of sophisticated techniques to determine the likelihood that they lead back to phishing or malware websites.
You can also see that encoded url now has jsession id added to it as cookies are disabled. If you click the encoded url version, you will remain in session and also sessionIdFromURL will return true (Previously when cookies were enabled, sessionIdFromCookie was returning true).
Do you need cookies to use URL rewriting?
However a browser may disable cookies for security and privacy reasons, in which case, session management through cookies will not work. Advantage of URL rewriting is that it will work even if cookies are disabled.
If the cookies are disabled at client side and we are using URL rewriting then this method uses the jsessionid value from the request URL to find the corresponding session. JSESSIONID cookie is used for session tracking, so we should not use it for our application purposes to avoid any session related issues.
Session management through cookies is supported by default by Java EE containers like Tomcat, whereas you need to encode your URLs with the JSESSION ID of the session to use url encoding. Both approaches have their advantage and disadvantage.