Session IDs within the URL

How to track a Session ID that is embedded in the URL Path.

About this task

If AppScan does not track session IDs correctly it will frequently fall out of session. This section describes how to track a session ID that is embedded in the URL.

Session ID: abc34f3fa135

URL containing session ID: http://domain.name/dir/subdir/abc34f3fa135/anotherdir?param=val

Procedure

  1. Create the rule for recognizing this custom parameter:
    1. Open Scan Configuration > Parameters and Cookies > Custom Parameters
    2. Click the plus button to add a new custom parameter.
    3. In the Reference Name field, enter a name for the custom parameter rule.
    4. In the Pattern field, enter a regular expression that describes the parameter format. Example: (abc[a-zA-Z0-9]+)
    5. Leave Value Group Index and Name Group Index unchanged.
    6. In the Location field, select Path.
    7. Click OK to save the changes.
  2. Configure AppScan to track this custom parameter:
    1. Open Scan Configuration > Parameters and Cookies > Parameters and Cookies
    2. Click the plus button to add a new parameter.
    3. Set the Type to Custom Parameter.
    4. Select the Reference Name you assigned in the previous step.
    5. Select the Track this parameter during the scan check box.
    6. Set Track Type to Login Value or Dynamic Value as appropriate.
    7. Click OK to save the changes.
  3. If the recorded login sequence includes a URL that contains this in-path session ID, you must record the login again so that AppScan can track the Session ID.
  4. Run a full Re-Scan or Re-Explore as needed.