Re: Replay attacks with cookie session

Jeremy Kemper
2007-03-23T15:31:35Z

On 3/22/07, Brad Ediger <brad@bradediger.com>
wrote:
> On Mar 22, 2007, at 7:27 PM, Jeremy Kemper wrote:
> > Avoiding a single database lookup isn''t the purpose of the
cookie
> > store.
>
> Sure, but you do remove a lot of the glamour of the cookie store if
> it has to be tied to a database for a nonce lookup anyway.

Smudge her mascara a little; she''s still sexy in the morning.

I already User.find(session[:user_id]) per request, so perhaps my
expectations are different from yours.


> > This discussion skipped plugging the session replay hole. I understand
> > your concern, but I think you underestimate the average Rails
> > developer.
>
> I might be over-concerned here, but I''m not talking about the
average
> Rails developer. I''m talking about the worst ones. I can tell you
> that while the average Rails developer I''ve worked with would
> certainly be able to understand this and work around it, I''m not
sure
> that the worst ones would even understand what the issue was if it
> were explained to them.

I don''t think you''re over-concerned. However, attempts to find
a
solution are not argument that session replay isn''t a problem.


> > For example: to prevent user_id replay, store a last access timestamp
> > in session that''s updated on login and logout.
>
> If I understand you correctly, you would also keep a copy of the
> latest timestamp server-side. I would submit that for many
> developers, storing a timestamp for each session on the server is not
> much more attractive than just storing the whole session on the server.

Let''s talk about practical fixes rather than whether we should write
it off entirely.

An application-level solution to user_id replay:

  Per request:
    @current_user User.find_by_id_and_last_seen_at(session[:user_id],
session[:last_seen_at])

  On login:
    @current_user.update_attribute :last_seen_at, Time.now
    session[:user_id] = @current_user.id
    session[:last_seen_at] = @current_user.last_seen_at

  On logout:
    @current_user.update_attribute :last_seen_at, Time.now
    reset_session

This requires one additional database query on logout to invalidate
future reuse of that session and no additional per-request queries.

Anyone care to try a generic, automatic nonce and benchmark the results?

jeremy