Date: Fri, 04 Oct 2013 00:07:02 -0600 From: Kurt Seifried <kseifried@...hat.com> To: Donald Stufft <donald@...fft.io> CC: oss-security@...ts.openwall.com Subject: Re: A note on cookie based sessions -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/03/2013 11:26 PM, Donald Stufft wrote: > I don't think this really is a vulnerability is it? I mean it's > basically how the internet works. The only difference between a > cooke backed session and a regular session is that there's no > server side session to destroy. At least in Django's case, It's not > a permanent session though, they are only good for a limited amount > of time before the signature on the cookie expires. > > If you have access to the session cookie you've already won the > game, you've gotten an XSS or MITM and can do much worse then a > session cookie. > Apologies I should have been more explicit. The difference is that with a stateful backend when the user hits log out they are logged out in the back end, so the cookie can't be used any more. With these stateless solutions there is no way to prevent cookie reply other than encoding a time out in the cookie (so I guess you could encode like a short time out and keep rotating the cookie to close the window of opportunity). The concern is people using public terminals, cookie stealing attacks, XSS in the website you're using, etc allowing an attacker to snag your cookie and use it post "log out". - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQIcBAEBAgAGBQJSTlsGAAoJEBYNRVNeJnmTTowQALWeB44M2xq1l6XZPYxfzoS3 EqRmHP2FT0ZrZH5wSiq4gTzecyke/nIf7JnrrcdNeirPPAl+NNqPS6TaOeguL20g SS5oqpC2rsEu1XveZC6M8YenqaPn8UQ04PYH8dCkyIholUKrh+bET5sTa5N90s33 wzYE80vAh9jdS9BH93iye+eFMzF+wfrEtgRsIg4kmD0Rt4L0f1KUkLoAQcdPq8tN 0Md4RocD0dQibKZ3j54ToxB7NxiEThYztf9pQLrJUYjuo9lIlIk9JCDkjQfGaIuR CgpB5LgX9eYnIgi+yI9DmPJHLNkwJE2dGWZPGaFnzmuw5cUKyLL5IEzOpRRgGraR b90lEP1R4/WAAfOWGyQ9eOoPQDm5WMfvjpfGw/djpuIPRAywAo3X+HnQwTVhHD8y kfuoYLQn+ymse9WEZPzKEOvW+AhSx/7LQ3vc+RNLr043zSaCzcaBWX8C3GhYAH+E ACwipVV0LQHto3KY8Oi86/nj7IvLU5uevpzdfSiUnRI1seGgj964Ka4nGcRL5tuw ZGsAj+h+vsiWFm2n9HS0OanKE+XU5XgMxzoC3HTrU0QZyIH0s8hebR8HzB8BVFW9 4uwvni/8AbhPY3ZUnNH2+/OTZvHm5V9O3frobA/c6eOOTG85JHpMnUR+pgur4rqV WsBNRKn596piipDwn1AS =Tqge -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.