Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 04 Oct 2013 11:27:01 +0600
From: "Alexander E. Patrakov" <patrakov@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: A note on cookie based sessions

Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> So this has been published:
>
> http://maverickblogging.com/logout-is-broken-by-default-ruby-on-rails-web-applications/
>
> http://maverickblogging.com/security-vulnerability-with-django-cookie-based-sessions/
>
> Basically it boils down to this: cookie based session handling where
> you don't store state data on the backend, but instead have a cookie,
> possibly with an expiration time coded into it can be used in replay
> attacks.

I am very much surprised that Flask is not mentioned at all in your 
e-mail. Its default session handler uses only signed cookies, and they 
can't even change the default because they don't have the DB layer or 
any other persistent storage out of the box.

Flask site is down at the moment, so no link to the documentation. But 
the problem is known, see this link for example:

http://stackoverflow.com/questions/13735024/invalidate-an-old-session-in-flask

-- 
Alexander E. Patrakov

-- 
Alexander E. Patrakov

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.