1

In the normal process, users request to logout from the client-side, then the server revokes that authentication cookie. Everything works fine if the network works as expected.

But it seems that there is a security risk in the situations described below:

situations:

  1. I set an authentication cookie for logged users on the server.
  2. the cookie marked as Http-only to prevent XSS attack.
  3. the cookie set 3 months expiration to prevent inputting credentials every time.
  4. Occasionally, the network is not working for some unknown reason when the user clicked the logout button so the browser keeps that cookie after the user logged out.
  5. but the wiki told me that I do not have the permissions to change the Http-only cookies by javascript.

Then no matter what you have done, the server didn't revoke that authentication cookie and that cookie remains in the browser. Then there is a security risk.

  • The whole purpose of the HttpOnly-flag is to make sure JavaScript can't interact with the cookie. They HttpOnly-flag is set by the server, and the client will send the cookie to the server with every request. – MechMK1 Aug 7 at 7:39
  • 2
    Perhaps it should be left up to the UI to communicate to the user whether they have been logged out or not? – multithr3at3d Aug 7 at 22:02
  • So, maybe the best solution is two steps: first, we should found a way to clear the cookie just like Sjoerd's answer. second, we raise up a dialog to tell people what to do in the next when the network is not reachable. @multithr3at3d – 欧阳维杰 Aug 8 at 2:37
4

Use a second cookie on top of the session cookie. When logging in, put some random data in that cookie and in the session. On every access, check whether these match. On logout, remove this cookie on the client side.

This second cookie is not HttpOnly, so you can remove it using JavaScript. To perform authenticated requests you need both cookies, and an XSS attack can't read the session cookie as its HttpOnly. So you get the advantages of HttpOnly while still being able to revoke the session on the client.

  • This may be the best solution. I am wondering if this is a standard way to handle this exception? – 欧阳维杰 Aug 7 at 7:28
  • Using two cookies is not common, but not unheard of. Two cookies are useful for SameSite cookies, where one is Lax and the other is Strict. I have never seen it before to ensure logout, as in your case. – Sjoerd Aug 7 at 7:35
  • I had checked youtube and stackoverflow. And I found most of the website can not logout when the network is unreachable. – 欧阳维杰 Aug 7 at 8:39
  • But if someone has copied the cookie, logging out locally won't prevent them from using it elsewhere. – multithr3at3d Aug 7 at 22:02
  • I think that should be the responsibility of the browser to prevent someone copes that cookie when that user is using the computer.@multithr3at3d – 欧阳维杰 Aug 8 at 2:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.