Skip to main content

Insecure session management

Need​

Secure session management

Context​

  • Usage of C# for developing robust and scalable applications
  • Usage of Microsoft.Extensions.DependencyInjection for Dependency Injection in .NET development
  • Usage of Microsoft.Extensions.Caching.Memory for in-memory caching in .NET applications
  • Usage of Microsoft.AspNetCore.Session for managing user sessions in ASP.NET Core
  • Usage of Microsoft.AspNetCore.Mvc for building web applications using the ASP.NET Core MVC framework

Description​

Non compliant code​

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddDistributedMemoryCache();

        services.AddSession(options =>
        {
            options.IdleTimeout = TimeSpan.FromSeconds(10);
            options.Cookie.HttpOnly = true;
            options.Cookie.IsEssential = true;
        });

        services.AddControllersWithViews();
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        app.UseSession();
        app.UseRouting();
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");
        });
    }
}

The above code represents an insecure session management vulnerability in an ASP.NET Core application. The session is configured in the ConfigureServices method with an IdleTimeout of 10 seconds. This means that the session will remain alive for 10 seconds of inactivity.

However, the vulnerability lies in the fact that the session token does not expire when the user terminates the session. This means that even after the user logs out, the session token remains valid for the duration of the IdleTimeout period. An attacker can exploit this vulnerability by intercepting the session token and using it to post requests to the server within the IdleTimeout period, even after the user has logged out.

This vulnerability can lead to unauthorized access and potential data breaches, as an attacker can perform actions on behalf of the logged out user. It is therefore critical to ensure that session tokens are invalidated upon logout to prevent this type of attack.

Steps​

  • Implement a session timeout mechanism to invalidate the session token after a certain period of inactivity.
  • Use a secure session storage mechanism instead of the in-memory cache. Consider using a distributed cache or a database to store session data.
  • Generate a new session token for each new session and ensure that the token is securely generated and cannot be easily guessed or brute-forced.
  • Set the 'HttpOnly' flag on the session cookie to prevent client-side scripts from accessing the cookie.
  • Set the 'Secure' flag on the session cookie to ensure that it is only transmitted over HTTPS.
  • Enable the 'SameSite' attribute on the session cookie to prevent cross-site request forgery (CSRF) attacks.
  • Implement proper session management practices, such as logging out the user when they explicitly terminate the session or after a certain period of inactivity.
  • Regularly review and update the session management implementation to address any new vulnerabilities or best practices.

Compliant code​

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddStackExchangeRedisCache(options =>
        {
            options.Configuration = "localhost";
            options.InstanceName = "SampleInstance";
        });

        services.AddSession(options =>
        {
            options.IdleTimeout = TimeSpan.FromMinutes(20);
            options.Cookie.HttpOnly = true;
            options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
            options.Cookie.SameSite = SameSiteMode.Strict;
            options.Cookie.IsEssential = true;
        });

        services.AddControllersWithViews();
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        app.UseSession();
        app.UseRouting();
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");
        });
    }
}

The updated code includes several changes to address the insecure session management vulnerability:

  1. Session Storage: The AddDistributedMemoryCache method has been replaced with AddStackExchangeRedisCache. This change switches the session storage from an in-memory cache to a distributed Redis cache. This is a more secure option as it allows for session data to be stored across multiple servers, reducing the risk of session data loss and providing better scalability.

  2. Session Timeout: The IdleTimeout property has been set to 20 minutes. This means that the session will automatically expire after 20 minutes of inactivity, preventing the session token from being used indefinitely.

  3. Secure Cookie: The SecurePolicy property has been set to CookieSecurePolicy.Always. This ensures that the session cookie is only transmitted over HTTPS, protecting it from interception during transmission.

  4. SameSite Cookie: The SameSite property has been set to SameSiteMode.Strict. This prevents the session cookie from being sent in cross-site requests, protecting against cross-site request forgery (CSRF) attacks.

  5. HttpOnly Cookie: The HttpOnly property has been set to true. This prevents client-side scripts from accessing the session cookie, protecting it from cross-site scripting (XSS) attacks.

  6. Essential Cookie: The IsEssential property has been set to true. This ensures that the session cookie is always created, regardless of the user's consent status.

These changes help to secure the session management in the application, reducing the risk of session hijacking and other session-related attacks.

References​

Last updated on