3

I want to run something by everyone. I'm trying to upgrade and do a major overhaul on a website and I've noticed something, when a user logs in. Several cookies get set like nicknames and a usernumbers. The website is an online store and I've noticed that if I change the cookie value, I can get other account's item listing. This is only if I hack the cookie value and change it by creating a custom program in .NET that will allow me to change all header info. To me, this poses a potentially massive problem security wise but I'm not sure if I am just being over paranoid or if this is a real threat. If it is a real threat, how can I be sure that the user is actually the user and that these cookies aren't being changed. So far I have zero evidence that this has happened before to this website. I remember reading about Yahoo! and that they got hacked by cookie forging. (I think that's what it was). I'm not sure if I'm explaining myself very well or not or if there is another place to ask this. If someone can point me to a resource or something it'd be much appreciated!

Edit (1): It should be noted that the cookie values are stored in plain text. This a bad move? Should I use this answer to improve security? Cookie Security

Edit (2): Ok, so this has been moved twice now, can anyone point me to something useful?

2

TL;DR: Use sessions over SSL

You are correct, this is a bad thing. The general rule of security in an application, never trust the user, applies here. The issue, is a lazy web developer will believe that a cookie doesn't count as user input.

This could not be further from the case. It is exceptionally easy to make modifications to any data sent to the server from the client, whether it be direct user input or a cookie.

There are plenty of use cases for cookies, and they play a key role in web security, but it this case, it sounds like they are about as secure as a hidden form element.

So how do you fix this? Sessions. A session also stores data as a cookie, but unlike your cookies, is just a long string. This serves as a secure (with a caveat) method for the server to identify a user. With each HTTP request, the session id is included. Once the server has associated a session with a client, relevant session data is stored on the server. The server knows what session to access based on the id sent by the client.

A session id is better for a few reasons, the server controls the data associated with the session, not the client. For example, you might store your cart total as a session variable. If the client had direct access to this, they could modify the amount they pay after you have submitted the purchase order, but before their card is charged.

You could safely store the privilege level of a user as a session variable, where it would be unsafe to do so as a regular cookie as well.

Now to the caveats. A session id is still not 100% secure. If I were to log onto your site over a public network, my authentication would be successful, and you would provide me a session id. Now, anyone who knows this id can use it to send HTTP requests as me. This is session hijacking. There also exist some timing attacks and such that attempt to reduce the entropy that exists in the session id.

You should only allow a user to login or communicate securely with your server over an SSL/TLS connection. This will greatly reduce the chances of a MITM attack or session hijacking. If you can also reset the session id and require the user to have entered their credentials within a certain timeframe. For example, hopefully your bank forces you to re login after a certain amount of time.

Here are some code examples in php for using sessions

session_start() // You must include this at the top of every page basically
                // I know, its odd, just go with it

$_SESSION['username'] = $user // How you could save the username to a session

session_unset() // Clear out the session (logout the user). If you really care
                // about security you will overwrite each session var first 
0

What I understand from your question is that you get a cookie like user_id=123 and if you change it to user_id=456 you are suddenly logged is as another user.

One possible way to prevent clients from altering cookies is by cryptographically signing them. In the cookie value you include both the actual value and a hash of the value and some secret key. Only people who have the secret key can then change cookies.

This is tricky to implement securely by yourself, so it would be best if this functionality is supported by the framework you are using.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.