Search code examples
sessiondrupaldrupal-8session-hijacking

Is there a way to check the authenticity of the user, after changing the Session Cookie?

Steps to re-create the issue:

  • Login with Admin Credentials and copy the session cookie.
  • Open another browser, Login as another user, paste the session cookie of the admin. Refresh the page. Now, you'll be logged in as Admin.

How to solve this issue? Any suggestions would be of great help.

Tried using the event subscriber to get the previous session before drupal loads the cookie session, but no luck with it.

Solution

  • This is not a problem, I mean, of course, Session Hijacking is a really big concern - but standard defences are fine.

    These are the controls that I know are widely known/used:

    • Ensure HTTPS is used everywhere,
    • Only use a securely created random string for the cookie value,
    • Set the secure flag on all cookies. This will ensure that they are only sent over an SSL connection,
    • Change the session cookie on each new login attempt.

    All of Drupal 8's cookies are secure by default.

    The exception is BigPipe's no-JS cookie, see https://www.drupal.org/node/2678628 — but there are no security consequences there.

    I know some very sensitive applications may also store - for each session - the following additional information:

    • SSL Session ID
    • HTTP User Agent
    • Remote IP Address

    In my point of view, I wouldn't bother with checking the HTTP User Agent or the remote IP address. They don't add that much security and they will break legitimate use in certain scenarios. Checking the SSL session ID (SSL session binding) would be OK from a security perspective, but could be painful to implement, the other defences are fine.

    If your concern is Cookie Theft via XSS, the best defence is to use standard methods to avoid XSS bugs in your web application. See OWASP for plenty excellent resources.

    You may find a lot of best practices to write secure code for Drupal 8 here: https://www.drupal.org/docs/8/security/writing-secure-code-for-drupal-8

    You may also find a pretty old discussion about this on Drupal here: https://www.drupal.org/project/drupal/issues/19845