This test ensures
that once a user "logs out" - they are actually logged out and it is
not possible to reuse the user's session.
Secondly, we check to see if there is a timeout feature where after X
amount of idle activity - the user is automatically logged out. The application
must work in a way where once logged out, all session tokens (cookies) are
either erased or made unusable. Usually,
we just want to make it unusable by rejecting the use of the cookie on a server
level.
To properly assess
this type of exploit, we must first find out what happens after a user logs
out. Are session cookies erased? Are they made unusable? The easiest way to do
this is by logging out, and then clicking the browser's back button. Are we
still authenticated? In that case the cookies are still being used and can be
exploited. If after clicking the back button we can still see visited pages but
not access any new pages - it means that the private information was cached.
The page allowed the browser to cache the content by "not setting the
cache-control header".
It is important to have some type of server side code that prevents the reusing of old cookies. Since cookies exists client side and can be edited by users, simply changing the values of the cookies to make it unusable is bad practice. We need to completely disallow an inactive cookie from doing any type of authentication.
No comments:
Post a Comment