[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <6B716FAF-8501-44A5-B854-9C30180A3A23@dot.ee>
Date: Fri, 4 Oct 2013 11:11:08 +0300
From: Andri Möll <andri@....ee>
To: oss-security@...ts.openwall.com,
kseifried@...hat.com
Subject: Re: A note on cookie based sessions
A lot of these frameworks or libraries also offer password remembering features which are often implemented as separate long lived token cookies that can't be invalidated server-side or can't be invalidated per-machine.
Devise for Ruby on Rails does this too, for example, but because of a side-effect of the implementation it can be invalidated by changing the password — the token is a substring of the password hash.
Andri
On Oct 4, 2013, at 9:07 AM, Kurt Seifried <kseifried@...hat.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 10/03/2013 11:26 PM, Donald Stufft wrote:
>> I don't think this really is a vulnerability is it? I mean it's
>> basically how the internet works. The only difference between a
>> cooke backed session and a regular session is that there's no
>> server side session to destroy. At least in Django's case, It's not
>> a permanent session though, they are only good for a limited amount
>> of time before the signature on the cookie expires.
>>
>> If you have access to the session cookie you've already won the
>> game, you've gotten an XSS or MITM and can do much worse then a
>> session cookie.
>>
>
> Apologies I should have been more explicit. The difference is that
> with a stateful backend when the user hits log out they are logged
> out in the back end, so the cookie can't be used any more. With these
> stateless solutions there is no way to prevent cookie reply other than
> encoding a time out in the cookie (so I guess you could encode like a
> short time out and keep rotating the cookie to close the window of
> opportunity).
>
> The concern is people using public terminals, cookie stealing attacks,
> XSS in the website you're using, etc allowing an attacker to snag your
> cookie and use it post "log out".
>
>
> - --
> Kurt Seifried Red Hat Security Response Team (SRT)
> PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.14 (GNU/Linux)
>
> iQIcBAEBAgAGBQJSTlsGAAoJEBYNRVNeJnmTTowQALWeB44M2xq1l6XZPYxfzoS3
> EqRmHP2FT0ZrZH5wSiq4gTzecyke/nIf7JnrrcdNeirPPAl+NNqPS6TaOeguL20g
> SS5oqpC2rsEu1XveZC6M8YenqaPn8UQ04PYH8dCkyIholUKrh+bET5sTa5N90s33
> wzYE80vAh9jdS9BH93iye+eFMzF+wfrEtgRsIg4kmD0Rt4L0f1KUkLoAQcdPq8tN
> 0Md4RocD0dQibKZ3j54ToxB7NxiEThYztf9pQLrJUYjuo9lIlIk9JCDkjQfGaIuR
> CgpB5LgX9eYnIgi+yI9DmPJHLNkwJE2dGWZPGaFnzmuw5cUKyLL5IEzOpRRgGraR
> b90lEP1R4/WAAfOWGyQ9eOoPQDm5WMfvjpfGw/djpuIPRAywAo3X+HnQwTVhHD8y
> kfuoYLQn+ymse9WEZPzKEOvW+AhSx/7LQ3vc+RNLr043zSaCzcaBWX8C3GhYAH+E
> ACwipVV0LQHto3KY8Oi86/nj7IvLU5uevpzdfSiUnRI1seGgj964Ka4nGcRL5tuw
> ZGsAj+h+vsiWFm2n9HS0OanKE+XU5XgMxzoC3HTrU0QZyIH0s8hebR8HzB8BVFW9
> 4uwvni/8AbhPY3ZUnNH2+/OTZvHm5V9O3frobA/c6eOOTG85JHpMnUR+pgur4rqV
> WsBNRKn596piipDwn1AS
> =Tqge
> -----END PGP SIGNATURE-----
Content of type "text/html" skipped
Download attachment "smime.p7s" of type "application/pkcs7-signature" (4790 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
