1

I have some scenarios:

  • A cookie is generated on Chrome and will be used in Firefox in the same machine.
  • A cookie is generated on Chrome and will be used in Chrome on a different machine.
  • A cookie is generated on Chrome and will be used in Firefox on a different machine.

In above scenarios, can cookie be reused? If not, how to implement a session/cookie to prevent reuse in those scenarios?

In my opinion, I think a session-cookie is implemented by:

  1. server stored a key-value pair so: key for identity user. and value for store user data, expired session time ...
  2. client will store cookie, in that cookie contains key on server.

So above attacks can be prevented by value object stores something such as "browser type", "machine name" (getting ssh value by some way). Every time user requests something, server will get browser type, machine name, cookie and check all data for validity.

But what is the problem if attacker can fake the browser type, machine name? For example, using Firefox but sending Chrome-details as browser-agent instead.

  • 2
    Two words: session ID – schroeder Jul 3 '16 at 18:13
  • 1
    Why/how do you plan to reuse cookies across browsers/machines? Your question does not show any research about how cookies and sessions function. – Jedi Jul 3 '16 at 18:23
  • @schroeder I have added to my question. Please review. I have thought about this problem, and see how can implement session-cookie, but always I can find a way for breaking. I know something wrong in this. ;( – hqt Jul 3 '16 at 18:30
  • What "attack" are you concerned about? It's really unclear how you think this is a problem. – Alexander O'Mara Jul 3 '16 at 18:58
  • 2
    All you really need is to prevent people from stealing your cookie in the first place. Just use https and mark it httponly. – Alexander O'Mara Jul 3 '16 at 19:36
3

You should think about threat models instead of coming up with solutions to fake problems.

What's the threat model here? That I copy my own session cookie to another computer? Not a real threat.

Worried about javascript stealing cookies? Use httponly cookies

Worried about malware stealing your cookies? Use a dedicated computer for sensitive network communications. You can get a Raspberry Pi Zero Wireless for $10

  • so in malware case, we cannot prevent right? – hqt Jul 3 '16 at 19:53
  • @hqt well, you can probably avoid getting malware, if you're careful yes – Neil McGuigan Jul 4 '16 at 2:17
2

You can not validate the used Browser and Machine Name (dont know at all how to get it), because all of that is send by the client, so an attacker can send what he want.

The security relies only on the session id, a long, random and unique id generated on the server and stored in the cookie.

You should give all the different machines where the user logs on a new session Id and not reuse an existing one, because if the user logs out on one machine you delete only that session id on the server and the user is not logged out on all of the other machines.

The only way for an attacker is to steel the session id stored on the user machine, but that requires a big security hole on the machine.

0

I thought each browser stores their own cookies. I have tested my lab's persistence using cookies with servers behind a load balancer so I don't face the scenarios you are facing. Getting a load balancer to front your servers seem like a wise choice, you can consider.

I have tried using different browsers on same client computer accessing the same site and I was load balanced to different web servers using cookie persistence. Unless I have used persistence based on source IP, every browser will go to the same web server.

1

I do not really understand your attacks. They are stated very vaguely. At risk of seeming pedantic, I would strongly suggest you avoid using the passive voice when describing behavior in a technical context.

Let me try to rewrite for you:

A cookie is generated on Chrome and will be used in Firefox in the same machine.

If you mean

"A legitimate user uses Chrome to access my site, which issues a session cookie. A malicious user copies the session cookie into the cookie store for Firefox, and accesses the site from there, thereby impersonating the legitimate user."

My answer to this: There is no mitigation in the world that will protect you from a malicious user with access to the legitimate user's machine.

If you mean

"A malicious user uses Chrome to access my site, which issues a session cookie. The malicious user copies the session cookie into the cookie store for Firefox, and accesses the site from there."

My answer to this: What does it matter if the malicious user is using Chrome or Firefox?

Anyway, please be specific about the threat you are assessing.

Also, be aware that all browsers maintain independent cookie stores, so there would have to be purposeful activity for session cookies to leak between them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.