Guidance on Session Hijacking Finding in SonarQube

SonarQube Server / Community Build
1

Hello Team,

I am reviewing session handling behavior in SonarQube and wanted to get some guidance from the community.

While testing, I observed that an authenticated session remains valid if the session cookie is reused in another browser session.

I wanted to understand:

  • Is this expected behavior in SonarQube by default?

  • Are there any recommended configurations or best practices for session hardening.

  • Are there any official references or documentation related to securing user sessions in SonarQube?

Any insights or recommendations would be helpful.

if you need still more inputs please reachout to me I will provide.

Thanks,
Salma.

3

Hi Salma,

Like every webapp that uses cookies to authenticate a user session, this is a risk.
It’s also the norm.

For someone to exploit this, they would need access to a user’s browser (or worse, whole machine), which means they can also piggyback onto the user’s existing session, so cookie reuse is probably the least of your worries.

Since you seem to have strong security requirements, the only suggestion I can make is to use network-level restrictions for your instance (e.g. IP allow-lists, company internal network, etc..)

Hope that helps!