2

I have read this article http://jaspan.com/improved_persistent_login_cookie_best_practice

i intend to implement cookie theft detection mechanism Barry Jaspan devised in it.

but a problem seemed to me.

i sent a letter about it to Jaspan several days ago, but he hasn't replied yet.

the problem is:

  • a user may open several (at least 2) tabs quickly in his browser.

  • the browser sends 2 requests with the cookie 'login_tok-dynamic_tok' to the application (our login system). login_tok is the token that will not change for the entire life time of the persistent login. dynamic_tok is the token that changes with every request.

  • first request that is executed by the server causes dynamic_tok to change in the database.

  • now the second request is processed and since the old dynamic_tok doesn't match the one in the database, a false positive will be generated.

  • This protocol is a horrible design and no profession application protects its self like this. OWASP and all of the other documentation we rely upon have reached a consensus: prevent the session id from being stolen in the first place. – rook Nov 6 '13 at 16:39
1

You're right, practically the issue will most likely happens when using one of the multiple Firefox facilities allowing to restore and then refresh multiple tabs at the same time.

Based only on the secret itself, I see no way to tell whether it has been stolen or not. The only solution I see is to add an expiration date to the token (there should be one anyway in order to purge very old unused tokens), and when a user shows a token keep it in the base but set its expiration date to a short delay (set expiration to one or two minutes ahead for instance). Maybe there should be an additional "used" flag added to ensure that the expiration date is update only once (otherwise an attacker who can update the date endlessly could preserve the token validity over time).

Then the "token theft" alert can be raised when the server receive a valid series associated to a non-existent or expired token.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.