RE: Session Fixation

This can be a problem with AOL users, Hannes Schmiderer mentioned in a posting earlier in the month that IP address changes across consecutive page hits can be a problem for AOL users (REF: http://webmaster.info.aol.com/proxyinfo.html ). Also the converse could occur where a large number of users behind say a corporate firewall (or university firewall) are all using the same IP address, it would make a session hijack relatively simple. This situation may be highly unlikely, but with security matters I feel that if (likelihood > 0) { solve(problem); } else { drink(beer); }

-----Original Message-----
From: Gary Gwin [mailto:websec@cafesoft.com] Sent: Friday, March 28, 2003 4:25 AM
To: webappsec@securityfocus.com
Subject: Re: Session Fixation

Thanks for posting, this is an excellent article.

One cavaet is with respect to binding the session ID to the browser's network address. There are some proxy servers that swap IP addresses between HTTP requests. In this case, binding to the exact IP address can cause a valid session to be orphaned.

Gary

St. Clair, James wrote:
> FYI - for those who have not seen it..

-- 

Gary Gwin
http://www.cafesoft.com

*****************************************************************
*                                                               *
*   The Cafesoft Access Management System, Cams, is security    *
*   software that provides single sign-on authentication and    *
*   centralized access control for Apache, Tomcat, and custom   *
*   resources.                                                  *
*                                                               *
*****************************************************************


******************************* DISCLAIMER ****************************** 
This e-mail and any attachments to it are confidential. 
If you receive them in error, please tell us immediately and delete them. 
You must not retain, distribute, disclose or otherwise use any information
contained in them. 

Before opening or using any attachments with this e-mail you should check
them for viruses and other defects. The sender does not warrant that they 
will be free from computer viruses or other defects.
*************************************************************************