Fix broken link on JSON Web Token Cheat Sheet for Java (#1079)

OWASP · Jan 29, 2023 · 6b73212 · 6b73212
1 parent 80a7f85
commit 6b73212
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.md b/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.md
@@ -108,7 +108,7 @@ A way to prevent it is to add a "user context" in the token. A user context will
 - A random string that will be generated during the authentication phase. It will be sent to the client as an hardened cookie (flags: [HttpOnly + Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#Secure_and_HttpOnly_cookies) + [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#SameSite_cookies) + [Max-Age](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie) + [cookie prefixes](https://googlechrome.github.io/samples/cookie-prefixes/)). Avoid setting *expires* header so that the cookie is cleared when the browser is closed. Set *Max-Age* to a value smaller or equal to the value of JWT token expiry, but never more.
 - A SHA256 hash of the random string will be stored in the token (instead of the raw value) in order to prevent any XSS issues allowing the attacker to read the random string value and setting the expected cookie.
 
-IP addresses should not be used because there are some legitimate situations in which the IP address can change during the same session. For example, when an user accesses an application through their mobile device and the mobile operator changes during the exchange, then the IP address may (often) change. Moreover, using the IP address can potentially cause issues with [European GDPR](http://www.eugdpr.org/) compliance.
+IP addresses should not be used because there are some legitimate situations in which the IP address can change during the same session. For example, when an user accesses an application through their mobile device and the mobile operator changes during the exchange, then the IP address may (often) change. Moreover, using the IP address can potentially cause issues with [European GDPR](https://gdpr.eu/) compliance.
 
 During token validation, if the received token does not contain the right context (for example, if it has been replayed), then it must be rejected.