I'm writing an app around a REST API which does not allow the server to invalidate a session - i.e. there's no endpoint like logout which will make the cookie my app is using be invalid from now on.

So I see that if a hacker intercepts that cookie, then a user logs out (which means for me - remove the cookie) and then the hacker is able to make calls to API despite the user thinking it's not possible anymore.

Can I do something else other than just remove the cookie?

Cookie has a timeout - 24h. This timeout is renewed every call to API.

  • Do you have the ability to put some type of proxy in between or create an intermediary API. Please add some more details to clarify. – Eric G Jul 17 '15 at 14:58
  • @EricG: If this will solve this problem then: yes. – Marian Paździoch Jul 17 '15 at 15:01
  • please expand your question. I am not quite clear of how using someone else's API affects your app unless you are create some type of mobile client app that doesn't go through your own service (you then exposing your dev key in the client source). – Eric G Jul 17 '15 at 15:04
  • If there isn't logout functionality I'm sure there's a timeout. I can't image an API that holds a session indefinitely. Check for how long your cookie is active and whether that time gets extended on every request. – user2320464 Jul 17 '15 at 15:13
  • @user2320464 yes, there is a timeout of 24h extended every call. – Marian Paździoch Jul 17 '15 at 15:27

This is actually not that uncommon a setup. Typically where an application uses stateless cookies, there's no way apart from timeout to invalidate the session.

The advantage of this appraoch is that the server doesn't need to maintain a list of valid cookies, which is handy for scaling, the downside is (as you've noticed) if the application has a long timeout there are risks relating to stolen sessions.

What you could do assuming the flow is

customer <--> your app <--> API

is if you give your customers a token created by your application and then maintain a mapping table so you effectively proxy all traffic between the customer and the API, you could then implement a logout function for your app which removed the token that the custoemr has on logout.

The API token would still be valid of course, but assuming that you can secure the link between your app and the API the main risk would be in the compromise of your app, which likely has more serious consequences that individual customers losing control of their session tokens.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.