Skip to main content

Lack of data validation - Session Cookie

Need​

Implementation of secure data validation for session cookies

Context​

  • Usage of Python 3.0+ for developing Python applications
  • Usage of Django for building web applications in Python

Description​

Non compliant code​

from django.http import HttpResponse
from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def set_session_cookie(request):
    cookie_value = request.GET.get('session_id')
    response = HttpResponse("Cookie Set")
    response.set_cookie('session_id', cookie_value)
    return response

The above code is a simple view function in Django that sets a session cookie. The function set_session_cookie is decorated with @csrf_exempt which means it does not perform any CSRF token checks.

The value of the cookie is directly taken from the GET parameter 'session_id' without any kind of validation. This is a major security vulnerability as it allows an attacker to set any value for the 'session_id' cookie. This can lead to several security issues such as session fixation attacks, session sidejacking, or even session hijacking if the attacker can predict or brute force the session IDs.

In a session fixation attack, the attacker can fix the user's session ID before the user even logs into the target site, thereby invalidating the need to steal the user's session ID post authentication. In session sidejacking, the attacker can capture the user's session ID over an insecure network and use it to gain unauthorized access to the user's account. In session hijacking, if the attacker can predict or brute force the session IDs, they can impersonate any user.

Therefore, it is essential to properly validate and secure session cookies.

Steps​

  • Implement server-side session management: Instead of accepting any value from the front end, generate a unique session ID on the server side.
  • Use secure and HttpOnly flags: This will ensure that the cookie is only sent over HTTPS and cannot be accessed through client-side scripts, reducing the risk of theft.
  • Set a reasonable expiration time for the session cookie: This will limit the time window in which an attacker can use a stolen cookie.
  • Validate the session ID: Before using a session ID, check that it corresponds to an active, authenticated session on the server side.

Compliant code​

from django.http import HttpResponse
from django.contrib.sessions.backends.db import SessionStore
from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def set_session_cookie(request):
    # Create a new session
    session = SessionStore()
    session.create()

    # Set the session cookie
    response = HttpResponse("Cookie Set")
    response.set_cookie('session_id', session.session_key, secure=True, httponly=True, max_age=3600)
    return response

The updated code now generates a unique session ID on the server side using Django's built-in session framework. This ID is then set as a secure, HttpOnly cookie with a reasonable expiration time (1 hour in this case).

The secure=True flag ensures that the cookie is only sent over HTTPS, preventing it from being intercepted during transmission. The httponly=True flag prevents the cookie from being accessed through client-side scripts, reducing the risk of theft through cross-site scripting (XSS) attacks.

The max_age=3600 parameter sets the cookie to expire after 1 hour. This limits the time window in which an attacker can use a stolen cookie.

Finally, the session ID is validated on the server side. Before using a session ID, Django checks that it corresponds to an active, authenticated session. This prevents an attacker from setting an arbitrary session ID and hijacking a session.

References​

Last updated on