oss-sec mailing list archives
Re: A note on cookie based sessions
From: Donald Stufft <donald () stufft io>
Date: Fri, 4 Oct 2013 01:26:46 -0400
I don't think this really is a vulnerability is it? I mean it's basically how the internet works. The only difference between a cooke backed session and a regular session is that there's no server side session to destroy. At least in Django's case, It's not a permanent session though, they are only good for a limited amount of time before the signature on the cookie expires. If you have access to the session cookie you've already won the game, you've gotten an XSS or MITM and can do much worse then a session cookie. On Oct 4, 2013, at 12:40 AM, Kurt Seifried <kseifried () redhat com> wrote:
Signed PGP part So this has been published: http://maverickblogging.com/logout-is-broken-by-default-ruby-on-rails-web-applications/ http://maverickblogging.com/security-vulnerability-with-django-cookie-based-sessions/ Basically it boils down to this: cookie based session handling where you don't store state data on the backend, but instead have a cookie, possibly with an expiration time coded into it can be used in replay attacks. That's a problem, but also an inherent limitation of how such session handling works. The advantages are a stateless backend, no need for state DB, if you have many backends, especially distributed, logins just work no matter which server you connect to. In both Drupal and Ruby on Rails case the security issues are documented: https://docs.djangoproject.com/en/1.5/topics/http/sessions/#using-cookie-based-sessions http://guides.rubyonrails.org/action_controller_overview.html#session the documentation can maybe be improved (especially mentioning HTTPS/HSTS to prevent sniffing of the cookie) but generally speaking this is covered, so no CVEs here. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
----------------- Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA
Attachment:
signature.asc
Description: Message signed with OpenPGP using GPGMail
Current thread:
- A note on cookie based sessions Kurt Seifried (Oct 03)
- Re: A note on cookie based sessions Alexander E. Patrakov (Oct 03)
- Re: A note on cookie based sessions Donald Stufft (Oct 03)
- Re: A note on cookie based sessions Kurt Seifried (Oct 03)
- Re: A note on cookie based sessions Andri Möll (Oct 04)
- Re: A note on cookie based sessions Kurt Seifried (Oct 03)
- Re: A note on cookie based sessions Florian Weimer (Oct 03)
- Re: A note on cookie based sessions cve-assign (Oct 04)
- <Possible follow-ups>
- Re: A note on cookie based sessions Igor Sverkos (Oct 04)