This question is similar to Hashing cookie-values & preventing cookie-stealing however, it is significantly different as I am interested in preventing (internal) subscription fraud, rather than an attack on the user's terminal from a malicious third party.
I have been using a simple local cookie to save my paid-subscriber site's user's user id. This prevents them from becoming annoyed by constant log-in requests. Nothing out-of-the-ordinary here.
My concern is that it is too simple and can too easily be hacked by cutting and pasting the PC's local cookie file.
If I were to track down my local cookie file on my PC, which is easy enough, I can copy it to a text reader and search until I find the info related to my site:
GA1.2.662049077.1549644533U8EMOÔ¬AÔ¡Aexample.com__atuvc/1%7C5~8GPRÄâ’ ¬AÄ…;N¡A.example.com__cfduid/d1240692ee84f4c8c756cee833d313a841558986 714ì±3µ”`ËoÙ_8OÑcˇ¡Aƒ¡Awww.mysite.commy_cookie/7www.example.com8O^~ Ã¡A¢π¡Awww.GA1.2.662049077.1549644533U8EMOÔ¬AÔ¡Aexample.com__atuvc/34 GA1.2.662049077.1549644533U8EMOÔ¬AÔ¡Aexample.com__atuvc/
And there it is:
It wouldn't take an overly talented analyst to figure out that this is a cookie which stores the user id for user # 7. If badhacker325 wanted perpetual access, badhacker325 could paste
www.mysite.commy_cookie/7 into the local cookie file and have perpetual, free access.
As coders and bakers of cookies, what tools do we have to prevent this kind of freeloading attack?
It might be germane to know that I am working in php; though the scope here goes beyond coding language, imo.
Not being the lazy sort, I have tried to work this out. I have solved for some scenarios, but I'm stuck on one component which I will identify below (mostly to maintain the suspense). Here are my attempts so far:
I have – instead of storing the simple user id
7 – created an array of:
user_id cookie_creation_time user_ip salt
I then imploded that to a delimited string, hashed it to unrecognizable bits and stored it. Now we get a cookie like this:
This, however, still does not stop a user from idiot-savant copying the hash to their local cookies file and gaining access to my site like nothing was ever wrong.
What it does do correctly:
When reading back the IP, the script can discover that the users location is different from the location at which the cookie was set. This is a fail state, and the user is requested to re-enter their password.
This solves for space, but not time. (I'm not Einstein yet.)
My next thoughts were to use the
creation_time value to test against a server value, and if that fails, to have the user re-enter their password. However, this seems to defeat the purpose of the
expires parametre of php's
I suspect that I am overthinking this — or perhaps have misinterpreted some aspect of cookie usage altogether.
Does anybody have any thoughts? How can we prevent a high-jacking of the user's local cookie file to exploit accepted cookie use?