Skip to main content

Lack of data validation - Session Cookie

Need​

Secure data validation for session cookies

Context​

  • Usage of TypeScript 3.8.3 for statically typed JavaScript development
  • Usage of Express for building web applications and APIs
  • Usage of cookie-parser for parsing and handling cookies in Express applications

Description​

Non compliant code​

import express from 'express';
import cookieParser from 'cookie-parser';

const app = express();
app.use(cookieParser());

app.get('/login', (req, res) => {
  const { username } = req.query;
  res.cookie('session', username);
  res.send('Logged in successfully!');
});

app.get('/report', (req, res) => {
  const sessionCookie = req.cookies.session;
  // Consume reporting services using the session cookie
  res.send('Report generated!');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

The vulnerability in this code is the lack of data validation for the session cookie.

In the /login route, the code takes the username value from the query parameters and sets it as the value for the session cookie using res.cookie('session', username). However, there is no validation or sanitization of the username value before setting it as the session cookie. This means that any value sent from the front end can be used to modify the session cookie.

In the /report route, the code retrieves the value of the session cookie using req.cookies.session and consumes reporting services based on that value. Since the session cookie can be modified by an attacker, they can set any value as the session cookie and gain unauthorized access to the reporting services.

The impact of this vulnerability is that an attacker can set any value as a session cookie, potentially impersonating other users or gaining unauthorized access to sensitive information or functionality. They can also consume reporting services without proper authorization.

To fix this vulnerability, data validation and sanitization should be implemented before setting the session cookie. This can include checking the validity of the username or any other relevant data, and rejecting or sanitizing any malicious or unauthorized values.

Steps​

  • Implement data validation on the username input in the '/login' route handler
  • Use a secure method to generate and set the session cookie value
  • Implement authentication and authorization mechanisms to validate the session cookie in the '/report' route handler

Compliant code​

import express from 'express';
import cookieParser from 'cookie-parser';

const app = express();
app.use(cookieParser());

app.get('/login', (req, res) => {
  const { username } = req.query;
  
  // Implement data validation on the username input
  if (!username || typeof username !== 'string') {
    res.status(400).send('Invalid username');
    return;
  }
  
  // Use a secure method to generate and set the session cookie value
  const sessionCookie = generateSecureSessionCookie(username);
  res.cookie('session', sessionCookie, { httpOnly: true, secure: true });
  
  res.send('Logged in successfully!');
});

app.get('/report', (req, res) => {
  const sessionCookie = req.cookies.session;
  
  // Implement authentication and authorization mechanisms to validate the session cookie
  if (!sessionCookie || !isValidSessionCookie(sessionCookie)) {
    res.status(401).send('Unauthorized');
    return;
  }
  
  // Consume reporting services using the session cookie
  res.send('Report generated!');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

function generateSecureSessionCookie(username: string): string {
  // Implement a secure method to generate the session cookie value
  // Example: return someSecureHashFunction(username);
  return '';
}

function isValidSessionCookie(sessionCookie: string): boolean {
  // Implement authentication and authorization logic to validate the session cookie
  // Example: return someAuthenticationLogic(sessionCookie);
  return false;
}

The fixed code addresses the vulnerability by implementing data validation and secure session cookie handling.

  1. The code uses the Express framework and the cookie-parser middleware to handle cookies.

  2. In the '/login' route, the code validates the 'username' input received from the front end. It checks if the 'username' exists and is of type 'string'. If the validation fails, a 400 Bad Request response is sent.

  3. The code then generates a secure session cookie value using the 'generateSecureSessionCookie' function. This function should be implemented to use a secure method, such as a cryptographic hash function, to generate the session cookie value based on the 'username'.

  4. The session cookie is set using the 'res.cookie' method with the 'httpOnly' and 'secure' options. The 'httpOnly' option ensures that the cookie is only accessible through HTTP requests and cannot be accessed by client-side JavaScript. The 'secure' option ensures that the cookie is only sent over HTTPS connections.

  5. In the '/report' route, the code retrieves the session cookie value from the 'req.cookies' object.

  6. The code then performs authentication and authorization checks on the session cookie using the 'isValidSessionCookie' function. This function should be implemented to validate the session cookie based on the authentication and authorization logic of the application.

  7. If the session cookie is not valid or missing, a 401 Unauthorized response is sent.

  8. If the session cookie is valid, the code proceeds to consume the reporting services and sends a 'Report generated!' response.

  9. The server listens on port 3000 for incoming requests.

  10. The 'generateSecureSessionCookie' function and 'isValidSessionCookie' function are placeholders that need to be implemented with secure and appropriate logic for generating and validating session cookies.

By implementing data validation, secure session cookie generation, and proper authentication and authorization checks, the fixed code prevents the modification of the session cookie value and ensures that only authorized users can access the reporting services.

References​

Last updated on