Re: Linking a cookie to an IP address is a very bad in 2015...

["Eric Vyncke (evyncke)" <[e-mail]>]

Jim

Thanks for offering to update the OWASP cheat sheet in the sections:

  *   "Session ID Content" (where it should be stated that the stored client IP address cannot be used for authentication check),
  *   "Session ID guessing" (where it should be stated that blocking on IP address can actually block hundreds of valid users when this address is shared by hundreds of ISP subscribers)
  *   but the major change is in "binding the session ID to other user properties" where clearly the session ID cannot be linked anymore to the client IP address

There is also another thing to change in this cheat sheet in section "Logging Sessions Life Cycle": logging the IP address has little meaning nowadays (heavy NAT in use), see RFC 6302 which recommends logging the remote/client TCP port as well.

I am more than happy to assist you in rewriting those sections

-éric



From: Jim Manico <[e-mail]<mailto:[e-mail]>>
Date: mercredi 1 avril 2015 17:44
To: Michael Sweet <[e-mail]<mailto:[e-mail]>>
Cc: Eric Vyncke <[e-mail]<mailto:[e-mail]>>, "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>
Subject: Re: Linking a cookie to an IP address is a very bad in 2015...

Michael,

I manage the cheatsheet series for OWASP. If you think this should be changed hit me up off list at [e-mail]<mailto:[e-mail]>

Aloha,
--
Jim Manico
@Manicode
[phone]

On Apr 1, 2015, at 1:13 PM, Michael Sweet <[e-mail]<mailto:[e-mail]>> wrote:

Here is the information our security guys rely on for best practices in web site session cookies:

    https://www.owasp.org/index.php/Session_Management_Cheat_Sheet

Client IP address is currently listed as one of the properties that can be used to bind the session ID to a specific client.

I'm not sure whether current PHP, etc. use the client IP or User Agent to validate the session ID...


On Apr 1, 2015, at 7:32 AM, Eric Vyncke (evyncke) <[e-mail]<mailto:[e-mail]>> wrote:

In the era of scarce IPv4 addresses, servers should NOT link the HTTP session cookies to the user-agent IP address...

I have posted in the IETF V6OPS WG the following:
http://www.ietf.org/proceedings/92/slides/slides-92-v6ops-6.pdf
https://tools.ietf.org/html/draft-vyncke-v6ops-happy-eyeballs-cookie

In short, heavy use of NAT and/or dual-stack (IPv4/IPv6) can cause a change of user-agent address => lost of session.

Any suggestion on how this can be addressed? I know at least two major web sites in Belgium that removed IPv6 from their web site due to this issue (and their security department not wanting to unlink IP address from the session cookies)

Comments are welcome

-éric


_________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair