4

Someone I know is registered on a community website where they can exchange messages etc. Taking a look at the email notification they receive when something new has been posted, contains an image with a link to their website, something like:

http://**********.org/****/id/abcdef0123456789abcdef0123456789

Where the last part seems to be some kind of a user's unique hash, that when you follow that link brings you directly onto the website under the user account, no authentication required!

A bit puzzled, I did the test and tried it out copying the link and using it on a different system in which that website has never been accessed before and sure enough with only that URL I could log into the user account without a hitch.

Looking at the cookies stored for this website, one is a PHPSESSID which value doesn't match the ID from the URL, so clearly that hash element must refer to a user account on the server, bypassing all sort of authentication.

I'm no expert in web-tech, but out of curiosity what kind of authentication is this called? Is it a popular way of logging user? This, to me, doesn't look secure at all (i.e. sniffing network can reveal this info straight away).

  • 1
    Are you sure the actual transmission is done via http? If so it is really bad. Otherwise when https is used, it may not be optimal, but it is not completely catastrophic. Are you sure that is does not expire? – John Dec 23 '15 at 11:33
4

If you can actually perform actions as the other user, it's called "really bad authentication". If it just takes you to their profile page, it's just a link - some systems will allow profile views even to unregistered users who have the appropriate link, even if it is normally restricted to logged in users.

Either way, be careful with experimenting in this way - following a link is probably fine, but modifying it can land you in trouble in some jurisdictions.

0

Note that the majority of websites allow users to reset their passwords by proving they have access to their email address. This form of password reset works in a similar way to the "one click login" feature you talk about - having access to that token (and therefore email) implies you are authenticated.

The main difference is that the user won't be aware that the link implies authentication. This means they might share the link with a friend or post it online without realising the implications.

If there really is a genuine requirement for this "one click sign on" functionality (yes, sometimes there is a trade off between security and usability) then the security implications could be narrowed by managing the tokens in the same strict way you should for password reset tokens:

  • Make the token one-time-use - this means it will log the user in instantly on the first click, and require re-authentication on subsequent clicks. When sending new emails, generate new tokens.
  • Expire the token in a reasonable amount of time, even if it was never used.
  • Allow only one active token per user - in conjunction with making the token one-time-use, this ensures multiple links can't be harvested and used later by an attacker.
  • Make the token completely unpredictable - use a long randomly generated string, using a secure source of entropy.
  • Communicate the feature to the user - so they know not to share it. You may also allow them to turn the feature off.

Things you shouldn't do

  • Don't persist the token in the url as a continued form of authentication. The user will definitely end up sharing the URL with others.
  • Don't try and generate "random" tokens by hashing the user's email address, don't use the current time either, or anything predictable like that. There's no need to be clever, just use a completely random value.
  • Don't have this feature on sites with very valuable user accounts, like banking or sites with private info. This could only ever be justified if you don't think there's a large cost associated with compromised accounts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.