ansaurus

Question

Session security: Zend_Session_Validator_HttpUserAgent

Answer 1

A:

It looks like this function is apart of a family of classes that do this:

This method should be used to retrieve the environment variables that will be needed to 'validate' a session.

This is so stupid it hurts. When your session is hijacked using XSS it will probably be sent as a GET request. In the incoming HTTP request will contain the USER_AGENT, as well as many other "environment variables" that the attacker can control.

Calling this approach a waste of time is an understatement. This is not a security feature, and sessions are can never be protected in this way.

If you want to protection your sessions scan for xss, patch CSRF, use https for the entire session. Read the OWASP top 10 for 2010, especially A3: "Broken authentication and session management."

Rook 2010-04-06 16:35:25

takeshin 2010-04-06 17:18:56

The $_SESSION['REMOTE_ADDR'] is the only thing the attacker cannot influence, and there for is the only comparison that will add any secuirty to the system. However, this breaks some corporate load balancing which will send traffic out on an arbitrary ip. There is no point in checking any other value, the attacker is going to try and just do a "javascript:document.cookie='whatever'", and when that doesn't work he'll change his headers using tamper data or whatever until it works. Checking the user agent gives you 0% secuirty.

Rook 2010-04-06 19:04:30

@takeshin User Agent Switcher: https://addons.mozilla.org/en-US/firefox/addon/59 or go to about:config in your address bar.

Rook 2010-04-06 19:10:27

takeshin 2010-04-06 19:40:33

@takeshin I disagree, this system does not prevent the session from being stolen, no matter the condition. Thus it is 0%. An attacker could just forge the entire header by default because of completely broken security systems like the one you are describing.

Rook 2010-04-06 20:21:46

@The Rook Anyway, I still haven't seen the example usage for the validator I was asking for :)

takeshin 2010-04-06 20:50:46

@takeshin Yeah, I haven't heard you speak of a security system that stops attacks.

Rook 2010-04-06 23:21:53

if($_SESSION['USER_AGENT']!=$_SERVER['spoofed_USER_AGENT']){die('hacker');}

Rook 2010-04-06 23:25:01

ansaurus

tags:

views:

answers:

Session security: Zend_Session_Validator_HttpUserAgent

related questions