Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
While reading through the newes OWASP ASVS standard (still beta) I have found a requirement V2.6 saying
Verify that the session id is changed or cleared on logout.
I do not see a clear point why it is necessary to have the session id changed or cleared after logout. It is necessary to have the session invalidated so after logging out no protected resources can be accessed. But why should I want to change the session id? Defense in depth?
EDIT: Another answer to the question.
. It is necessary to have the session invalidated so after logging out no protected resources can be accessed. But why should I want to change the session id? Defense in depth?
The Session ID itself can be viewed as a piece of private information that was associated with the authenticated user session. Clearing this ID from the client side ensures that this private value is no longer available.
Yes it is a sort of defense in depth, as you will be able to verify from the client side that the session has changed which would imply that the server does not know anything more about the current session (i.e. not tied to any user account or is holding any private data, etc). If you were reviewing an application against the ASVS standard and you noticed that the Session ID had changed on logout you can be pretty sure that all session data has been cleared and is no longer available from the client. Yes, technically it is possible to code a system to migrate any session data to the new session, but as there is no real reason to do this it is a good measure of the quality of the application's session handling.
In addition, sending the old ID can be done as part of the testing to ensure that it is no longer recognised as an authorised session.
Because of possible session fixation: http://en.wikipedia.org/wiki/Session_fixation
In computer network security, session fixation attacks attempt to exploit the vulnerability of a system which allows one person to fixate (set) another person's session identifier (SID). Most session fixation attacks are web based, and most rely on session identifiers being accepted from URLs (query string) or POST data.
Another problem: if user has same session id after logout (even if session contents are cleared), attacker gains possibility to prolong usage of stolen session id. Alice logs in to some site; Attacker steals cookie with session id; Alice logs out of site; Attacker can't use stolen cookie to access the site; Alice logs in to the site; Attacker can use stolen cookie, because Alice's session id is the same;
Rule of thumb is to change session id as often as you can.
It's another way of saying the same thing. The goal is that a malicious user who captures the session id of an authenticated user should not be able to continue to use that session id to interact with the application as the authenticated user after the user has logged out. After log out, the application should no longer recognize that session id. From an implementation perspective this can mean that you invalidate the session, or change the session id on the server so that it can no longer be referenced by the old session id.
