Skip to main content

Insecure functionality - Session management

Need​

Secure session management

Context​

  • Usage of Dart 2.0 for building scalable and efficient web applications
  • Usage of Shelf for managing and organizing data in a Node.js application

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;

class Session {
  String id;
  DateTime expirationTime;

  Session(this.id, this.expirationTime);
}

final sessionMap = <String, Session>{};

shelf.Response handleRequest(shelf.Request request) {
  final sessionId = request.headers['sessionId'];
  final session = sessionMap[sessionId];
  
  if (session != null && DateTime.now().isBefore(session.expirationTime)) {
    // Handle authenticated request
    return shelf.Response.ok('Authenticated request');
  } else {
    // Handle unauthenticated request
    return shelf.Response.forbidden('Unauthenticated request');
  }
}

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests()).addHandler(handleRequest);
  shelf.serve(handler, 'localhost', 8080);
}

The above code is a simple Dart server using the Shelf framework. It uses a basic session management mechanism where sessions are stored in a map and retrieved using a session ID from the request headers.

The vulnerability lies in the session validation within the handleRequest function. The function checks if the session exists and if it hasn't expired yet. If both conditions are met, it handles the request as an authenticated request.

However, the expirationTime of a session is stored in the session object itself, which is stored in a map on the server. This means that if an attacker can somehow gain access to the server's memory or the session map, they can modify the expirationTime of an expired session to a future time, thus making the session valid again.

This is an insecure session management vulnerability because it allows an attacker to prolong a session indefinitely by simply modifying the session's expiration time.

Steps​

  • Ensure that the session expiration time is managed server-side and cannot be modified by the client.
  • Implement a mechanism to invalidate the session token once it has expired, and do not allow it to be reactivated.
  • Consider using a secure session management library that handles these issues automatically.
  • Regularly rotate session tokens to limit the potential damage if a token is compromised.
  • Consider implementing additional security measures, such as re-authentication for sensitive operations.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;

class Session {
  final String id;
  final DateTime expirationTime;

  Session(this.id, this.expirationTime);
}

final sessionMap = <String, Session>{};

shelf.Response handleRequest(shelf.Request request) {
  final sessionId = request.headers['sessionId'];
  final session = sessionMap[sessionId];
  
  if (session != null && DateTime.now().isBefore(session.expirationTime)) {
    // Handle authenticated request
    return shelf.Response.ok('Authenticated request');
  } else {
    // Handle unauthenticated request
    // Remove the expired session from the sessionMap
    sessionMap.remove(sessionId);
    return shelf.Response.forbidden('Unauthenticated request');
  }
}

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests()).addHandler(handleRequest);
  shelf.serve(handler, 'localhost', 8080);
}

The updated code includes a mechanism to invalidate the session token once it has expired. This is done by removing the expired session from the sessionMap in the handleRequest function. This ensures that once a session has expired, it cannot be reactivated by modifying the expiration time.

The Session class has also been updated to make the id and expirationTime fields final. This means that once a Session object has been created, its id and expirationTime cannot be changed. This helps to ensure that the session expiration time is managed server-side and cannot be modified by the client.

These changes help to mitigate the risk of session token manipulation by ensuring that expired session tokens cannot be reactivated and that the session expiration time cannot be modified after the session has been created.

For further security, consider using a secure session management library that handles these issues automatically, regularly rotating session tokens to limit the potential damage if a token is compromised, and implementing additional security measures such as re-authentication for sensitive operations.

References​

Last updated on