[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <524E51A5.4010708@gmail.com>
Date: Fri, 04 Oct 2013 11:27:01 +0600
From: "Alexander E. Patrakov" <patrakov@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: A note on cookie based sessions
Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> So this has been published:
>
> http://maverickblogging.com/logout-is-broken-by-default-ruby-on-rails-web-applications/
>
> http://maverickblogging.com/security-vulnerability-with-django-cookie-based-sessions/
>
> Basically it boils down to this: cookie based session handling where
> you don't store state data on the backend, but instead have a cookie,
> possibly with an expiration time coded into it can be used in replay
> attacks.
I am very much surprised that Flask is not mentioned at all in your
e-mail. Its default session handler uses only signed cookies, and they
can't even change the default because they don't have the DB layer or
any other persistent storage out of the box.
Flask site is down at the moment, so no link to the documentation. But
the problem is known, see this link for example:
http://stackoverflow.com/questions/13735024/invalidate-an-old-session-in-flask
--
Alexander E. Patrakov
--
Alexander E. Patrakov
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
