Beefy Boxes and Bandwidth Generously Provided by pair Networks
There's more than one way to do things

Re: Check the cookie for changes

by maverick (Curate)
on Mar 25, 2002 at 15:43 UTC ( #154124=note: print w/replies, xml ) Need Help??

in reply to Check the cookie for changes
in thread Web based password management (or how *not* to blame tye)

The session ids that I'm using here are those generated by Apache::Session itself. They appear to be a md5 hash of some sort (I've not really looked into *how* they are generated). That's the only piece of info ever stored in a cookie, and validating if the cookie has been tinkered with is easy.
eval { # tie to session_id (sorry it's monday morning don't remember the +exact syntax) } if ($@) { print "bogus session\n"; }
basically if you ask apache session to access a session that doesn't exist it dies. Thus the eval...

perl -l -e "eval pack('h*','072796e6470272f2c5f2c5166756279636b672');"

Replies are listed 'Best First'.
Re: Re: Check the cookie for changes
by drewbie (Chaplain) on Mar 25, 2002 at 16:02 UTC
    True, that would work fine if all you're storing in the cookie is the session id. I usually put a little more in the cookie than just the id, so using a hash to verify the value I put there is second nature to me.

    Here's a scenario: User A get a cookie w/ the session and logs into a web app w/ sensitive data. User B has access to User A's computer (hacker, social engineering, etc) and gets the session ID. User B then creates a session cookie like User A's, and now he can see the sensitive data he should not have access to. Using a checksum on the cookie value can help to avoid situations like this. And there really is not a downside. You write the code once, it uses C based modules so it's fast, and you prevent one less possible security problem. Maybe you'll never run across this situation, but should you do so you don't have to worry.

    Just a thought...

Re: Re: Check the cookie for changes
by belg4mit (Prior) on Mar 28, 2002 at 02:05 UTC
    The default, Apache::Session::Generate::MD5, does MD5->hexhash(time(). {}. rand(). $$)/ Systems such as ASP under IIS appear to have session ID's that are partially determined by the client headers the (User-agent, Accept, etc.)

    PS> I was horrified re-reading the Apache::Session documentation that in the SYNOPSIS they place a cc number in the session data.

    perl -pe "s/\b;([st])/'\1/mg"

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://154124]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others chanting in the Monastery: (2)
As of 2019-08-25 03:17 GMT
Find Nodes?
    Voting Booth?

    No recent polls found