Re: Replay attacks with cookie session

Brad Ediger
2007-03-21T19:19:42Z

On Mar 21, 2007, at 1:43 PM, S. Robert James wrote:

>
> I''m concerned about the possibility of replay attacks with cookie
> sessions.  This is a standard security issue.
>
> Example:
> 1. User receives credits, stored in his session
> 2. User buys something
> 3. User gets his new, lower credits stored in his session
> 4. Evil hacker takes his saved cookie from step #1 and pastes it back
> in his browser''s cookie jar.  Now he''s gotten his credits
back.
>
> This is normally solved using something called nonce - each signing
> includes a once only code, and the signer keeps track of all of the
> codes, and rejects any message with the code repeated.  But that''s
> very hard to do here, since there may be several app servers
> (mongrels).
>
> Of course, we could store the nonce in the DB - but that defeats the
> entire purpose!
>

You and I think alike. I was just considering this the other day as
well. The trivial fix is to say "don''t store sensitive transient
data
in the session". I think that leaves something to be desired, but it
is probably the preferred route unless there is a clean technical
solution.