Full Disclosure mailing list archives
[Django] Cookie-based session storage session invalidation issue
From: "G. S. McNamara" <main () gsmcnamara com>
Date: Tue, 1 Oct 2013 16:20:55 -0400
FD, I’m back! Django versions 1.4 – 1.7 offer a cookie-based session storage option (not the default this time) that is afflicted by the same issue I posted about previously concerning Ruby on Rails: If you obtain a user’s cookie, even if they log out, you can still log in as them. The short write-up is here, if needed: http://maverickblogging.com/security-vulnerability-with-django-cookie-based-sessions/ Cheers, G. S. McNamara
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [Django] Cookie-based session storage session invalidation issue G. S. McNamara (Oct 02)
- <Possible follow-ups>
- Re: [Django] Cookie-based session storage session invalidation issue Paul McMillan (Oct 03)
- Re: [Django] Cookie-based session storage session invalidation issue G. S. McNamara (Oct 03)
- Re: [Django] Cookie-based session storage session invalidation issue G. S. McNamara (Oct 03)
- Re: [Django] Cookie-based session storage session invalidation issue Paul McMillan (Oct 03)
- Re: [Django] Cookie-based session storage session invalidation issue G. S. McNamara (Oct 03)
- Re: [Django] Cookie-based session storage session invalidation issue Paul McMillan (Oct 03)
- Re: [Django] Cookie-based session storage session invalidation issue G. S. McNamara (Oct 03)
- Re: [Django] Cookie-based session storage session invalidation issue Jeffrey Walton (Oct 03)