2

So I've lost all of my Firefox bookmarks (well not since 3.0) or history (3.5?) or my current session enough times (yeah... this still happens) that I don't leave my precious Firefox profile to chance, so I zip it up as a backup weekly. About a year ago, I unzipped one of my very old profiles because I had lost a session or something, and noticed that it still had active logins to all of my websites!

It was a long time until I realized that Firefox wasn't clearing cookies on exit like I had configured it to ("Keep Until: I close Firefox"). I also tried setting up "Clear history when Firefox closes" with "Cookies" and "Active Logins" both selected, and Firefox wipes neither. Eventually, I posted a bug on Bugzilla for it.

Now, I use my Settings Buttons extension to quickly open the Cookies dialog and wipe all of my cookies before closing my browser for the day. My question: is this any more or less secure than individually logging out of everything I log into to deauthenticate those sessions, or am I fine wiping all of my cookies?

Improve this question

2 Answers 2

Reset to default
5

Logging out is supposed to expire the cookies/sessions, but that depends on the server-side coding.

If the cookies were stolen and you only deleted your cookies, then the stolen cookies might still be valid.

The choice of deleting vs logging out has more to do with what you are trying to defend against. Cookies contain more data than just the session info.

The best method is to do both: log out to end the session and then delete cookies to remove any potentially sensitive data.

Improve this answer
4
  • 4
    To be clear: deleting your cookies alone (or first) is a bad idea, as the session might still persist on the server. Best option is to log out, then delete any remaining cookies.
    – Polynomial
    Jun 18, 2015 at 20:48
  • Do either of you know how Firefox's Active Logins wipe works? I don't know if that's the same as deleting cookies or if it accesses the websites with active logins and tells them to log out.
    – NobleUplift
    Jun 18, 2015 at 22:13
  • @polynomial absolutely right. I will find a way to highlight that fact.
    – schroeder ♦
    Jun 18, 2015 at 22:22
  • Firefox Active Logins only removes the sessions on the client side. Otherwise it would have to know where the logout script location is. For example in PHP my script could be logout.php, /logout, index.php?action=logout, auth.php?task=logout&token={randomly generated hash} or millions of other possibilities. Without this being known and executed the server session will still be persisted.
    – Bacon Brad
    Jun 19, 2015 at 20:11
1

It is more insecure. Many competent web developers actually destroy the session on the server side to prevent it from ever being accessed again. For example, a PHP dev might do something like.

// Unset all of the session variables.
$_SESSION = array();

// If it's desired to kill the session, also delete the session cookie.
// Note: This will destroy the session, and not just the session data!
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}

// Finally, destroy the session.
session_destroy();

If you delete your cookies/sessions from within your browser it does not have the server access to do the above. Nor does it know the script location for logging out. If an attacker managed to get your session data prior to deletion or gained access by guessing the session name and value the session might still be accessible.

Additionally security inclined devs do take this into consideration and give sessions an expiration date or store your ip/user agent in the session and match it to the person making the session request before executing an authored action. But an user agent can be spoofed and not all sites take such measures.

Improve this answer
2
  • $_SERVER['REMOTE_ADDR'] in itself is not spoofable as the remote IP. But it does suffer the chance of being spoofed in other ways due to proxies, gateways, etc which in itself doesn't make a secure way to match since it won't always return a remote IP. For example if this is an intranet site and user X connects using local IP of 10.0.1.123 nothing is to stop user Y on the network from changing their network properties to use this same internal IP as well. So spoofable, yes, there still remains a possibility but I removed it to avoid confusion.
    – Bacon Brad
    Jun 19, 2015 at 20:21
  • 1
    That's better. In the case of IP reuse or IP overloading, that's not technically 'spoofing' (spoofing is something else).
    – schroeder ♦
    Jun 19, 2015 at 20:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .