1

I am learning about auth and session management, and using express-session in Node js. I am not able to find the need for this package. I read a about it online, but didn't get a satisfying answer. Considering it is used widely, I am missing something.

I know when the user enters email/username and password, the server then checks these values against the database, and if successful, returns a unique session id.

On the server side, we anyway have to find out the user who made the request by a lookup to the database (by session id --> user id --> database lookup). Also, the session id which is send to the client is signed (in express-session), to ensure it is not tampered with.

My main doubt is, we're signing the session id, then why is it considered unsafe to send the user id instead. This post here: Why we store session id instead of user id inside cookies? talks about how the attacker can modify the plain user id and compromise the system. But in our case, as we're sending a signed user id, no one will be able to modify it unless they know my secret (which is used to sign it).

This is taken from the post I shared above:

If an id leaks even once, an attacker would gain permanent access as it is unrevokable. Session ids on the other hand expire after a while or can be revoked.

This makes some sense, but then if the attacker gets hold of the signed session id too, no one can stop him from using that session (unless he modifies something).

So is it just a matter of revoking/expiration ability of the session ids that the user ids don't have?

More explanation will be appreciated, as I am just starting to learn these things. Thanks

1 Answer 1

1

A session can be terminated

Imagine that Alice, who has user ID 1337 logs into your system and gets the session with the ID 4919. Now imagine Eve would somehow be able to get a hold of the signed session token - e.g. by using an XSS attack.

Alice notices that something is up, and she logs out of the application - thus terminating the session on the server side. Eve would now see the message that her session has expired, but since she does not have the credentials, she cannot log in and can do no further damage.

Why is this the case?

When creating sessions, there is a layer between the token that the user presents to log in, and the user themselves. That means sessions are short-lived, and any stolen tokens would not be valuable for long.

On the other hand, if you use the signed user ID as authentication, then once the token is leaked, it is leaked, and the user is in a very bad position.

Could it still be done stateless?

Yes, that's what JWT aims to do. Basically, it signs the user ID, but also a time of expiry. This means that you essentially have a token that says "User 1337 is permitted to log in until 2020-04-11 18:13:22". This shifts the attack surface a little, since before, an attacker had to crack the signature key and guess legitimate session tokens, and now all they need is to crack the signature key - or perhaps, they don't need it at all, if the server is misconfigured.

2
  • Thanks for presenting a scenario. So in the end, its the ability to revoke and shutdown access completely from that token, which is only possible if we're using temporary sessions ids. Nov 5, 2020 at 13:00
  • @SatvikNema Exactly. If you would sign the user token instead, it becomes impossible to invalidate that token anymore.
    – user163495
    Nov 5, 2020 at 13:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .