| Subject: | Session fixation vulnerability |
| Date: | Sat, 23 May 2009 23:49:28 +0200 |
| To: | bug-Catalyst-Plugin-Authentication [...] rt.cpan.org |
| From: | kmx <kmx [...] volny.cz> |
I guess that the current implementation of
Catalyst-Plugin-Authentication (or maybe Catalyst-Plugin-Session) does
not prevent Session fixation attack because it does not force generation
of new sessionid (=cookie) during authenticate() and logout().
It could be handled by some additional code in the cat application:
[LOGIN]
if ($c->authenticate( { username => $user, password => $pass } )) {
$c->create_session_id();
...
}
...
note: it probably is also not optimal as create_session_id() is declared
to be an internal method of "Catalyst::Plugin::Session" (it probably
means something like "could be changed without notice")
[LOGOUT]
sub logout :Global :Args(0) {
my ( $self, $c ) = @_;
if ($c->user_exists) {
$c->delete_session("logout");
$c->logout();
...
}
...
However in my opinion the framework itself should prevent session
fixation attack.
My proposal is to force sessionid change (new id) during both discussed
calls:
- authenticate()
- logout()
The problem might occur with applications that first uses the session in
"anonymous phase" (e.g. user is adding goods into cart before login),
then let user log in and want to keep his/her session data for
"authenticated phase" (to finish the order and pay for it). To prevent
session fixation in this scenarion it is necessary to give the user a
new sessionid and make a copy of session data.
Patching logout() method seems to be quite straightforward - something
like this:
--- Authentication.pm ---
sub logout {
my $c = shift;
+ if ($c->can('session') and
$c->config->{'Plugin::Authentication'}{'use_session'} ) {
+ $c->delete_session("logout")
+ }
$c->user(undef);
---
Little bit tricky is authenticate() as we have to handle two modes:
1) we want the complete reset and clean new session
2) we want just to chage sessionid but keep session data
I would propose a new authenticate() parameter "keepsessiondata" that
will indicate the mode.
What I have no idea how to do is copying the session data in case we
want to keep them. The interface of Catalyst::Plugin::Session does not
help much - I am afraid that it might require to implement some
additional method for "cloning/copying" existing session data.
Any idea?
--
kmx