oss-security - A note on cookie based sessions

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <524E46C1.6020900@redhat.com>
Date: Thu, 03 Oct 2013 22:40:33 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: A note on cookie based sessions

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

So this has been published:

http://maverickblogging.com/logout-is-broken-by-default-ruby-on-rails-web-applications/

http://maverickblogging.com/security-vulnerability-with-django-cookie-based-sessions/

Basically it boils down to this: cookie based session handling where
you don't store state data on the backend, but instead have a cookie,
possibly with an expiration time coded into it can be used in replay
attacks.

That's a problem, but also an inherent limitation of how such session
handling works. The advantages are a stateless backend, no need for
state DB, if you have many backends, especially distributed, logins
just work no matter which server you connect to.

In both Drupal and Ruby on Rails case the security issues are documented:

https://docs.djangoproject.com/en/1.5/topics/http/sessions/#using-cookie-based-sessions

http://guides.rubyonrails.org/action_controller_overview.html#session

the documentation can maybe be improved (especially mentioning
HTTPS/HSTS to prevent sniffing of the cookie) but generally speaking
this is covered, so no CVEs here.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)

iQIcBAEBAgAGBQJSTkbBAAoJEBYNRVNeJnmTnI8QAJyoi0yWRmTzVHUiwMx/mcSa
eum+9cMtxLi/TvB7KMtXJqCE9tRZ11R8gCqLpzxyuKOnFUoh2pK0OSm9oz2r0nkK
xUsshwcEy9a4Ih9ICdPUBo9APQ8LoW0rGCqACP/BjKSs41As1IiJzN/wAm/Oshmj
8n66ERqdpTeQlYfQQqHsAk3mbI4k9kKvYnO6yMrQe2GJ5vPW97O3FiSqasg8oqvt
rvO6tdTElKfYIbp9JdgduMsNwyXsTSHUf4j2yW71NJHYf1Rh/CkldG1Q69Y3gCAo
huYRBL/vzN3vDPhFWufovS7iHjSDDc20Uorxu7OO7WKp30yk9OpZZh/hx5myHQhd
kZiaA9Zc2MkW8Fum1+onAJUqVJuAg8CH0ChABorCNhepvAfptS32UNFr9eBLVpxy
+YfXkMFV6aW9549SuUHOjOsXXNfctjaVx+e0gvPwYilCj5On8FlNoCCJGA1QtA3P
9B6GCc8TfHd7+5wx3qOTMTJhbxUg2R6sZ+NLwxLYgjd+sImYnbRFBhjo+EtUXMEp
iPWdsC6zXnFhciUcznf+Ggg3gNRVVkH9cZUnczmR4nFe2tT6Gu6B75juzXQWG4rq
51Tl2TfiSGgVzSlHBksvtmJSBv9GO84JtH0hrI1u40h4HBvjJNJNZr8kILKIGXBu
27G8kN5NeQh+oEYmIL9d
=rjhT
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.