The jfwid contains the session ID
Closed this issue · 1 comments
jasondlee commented
The client window ID generated in ClientWindowImpl contains the session ID, which is not needed for this functionality, and exposure of the session ID can be used to compromise security. This method should be modified, then, so as not to use the session. PR incoming.
arjantijms commented
+1 indeed for not leaking the session ID anyway, and even more so when it's not needed.