Re: Hijacking URL Encoded Session IDs using Referer Logs

One, I could have missed it, but I don't see anything in the owasp security guide advising application developers to disable URL encoded session IDs.

Two, you can't tie the origin of the the request (the IP address) to the session for reasons that have been discussed here time and time again.

Three, expiring sessions in a "timely" manner accomplishes nothing. 0 seconds is the only safe timeout. A cracker could write a program that monitors the HTTP referrer headers and e-mails her (hell, pages her) as soon as it sees something that looks like a session ID.

Four, most people worry about XSS attacks. Many sites (and web mail clients) allow links, and they also support URL-based session IDs. The *only* reason I bring this up is that I've seen examples of issue in my referer logs.

Bob

Jeff Dafoe wrote:

>>Many (most?) application servers use URL encoded session IDs when the
>>user has disabled cookies. Many users disable cookies as a security
>>precaution. There should be an advisory on this so that application
>>server vendors stop allowing URL encoded session IDs by default.