IETF Logo Mail Archive

Re: Linking a cookie to an IP address is a very bad in 2015...

Jim Manico <jim@manico.net> Wed, 01 April 2015 21:49 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 286EA1A870F for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 1 Apr 2015 14:49:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.91
X-Spam-Level:
X-Spam-Status: No, score=-6.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nSbMK6LUD97H for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 1 Apr 2015 14:49:07 -0700 (PDT)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C17A1A8707 for <httpbisa-archive-bis2Juki@lists.ietf.org>; Wed, 1 Apr 2015 14:49:07 -0700 (PDT)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1YdQRv-0002wD-HD for ietf-http-wg-dist@listhub.w3.org; Wed, 01 Apr 2015 21:45:23 +0000
Resent-Date: Wed, 01 Apr 2015 21:45:23 +0000
Resent-Message-Id: <E1YdQRv-0002wD-HD@frink.w3.org>
Received: from maggie.w3.org ([128.30.52.39]) by frink.w3.org with esmtp (Exim 4.80) (envelope-from <jim@manico.net>) id 1YdQRs-0002ut-1E for ietf-http-wg@listhub.w3.org; Wed, 01 Apr 2015 21:45:20 +0000
Received: from mail-pd0-f177.google.com ([209.85.192.177]) by maggie.w3.org with esmtps (TLS1.0:RSA_ARCFOUR_SHA1:16) (Exim 4.72) (envelope-from <jim@manico.net>) id 1YdQRq-00031d-P5 for ietf-http-wg@w3.org; Wed, 01 Apr 2015 21:45:19 +0000
Received: by pddn5 with SMTP id n5so67707146pdd.2 for <ietf-http-wg@w3.org>; Wed, 01 Apr 2015 14:44:52 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=Be4vGobcQyIpJKkEsnAHeSUxSO2pBtdPK/CQn0pKDfI=; b=JUCb+7Np1p1ejDjxr4LlwpO8VcAfo8l8XUOhoWBDD151Ue58E63aUp+wF8kJNV0tQi PsXO78zJoGRye6wC9SSd6ZlWX6cADhHljhGi8hNUStcn/dgyoDUBiJeT9ytw+wgZRKME 9ZUd36MQPDdTfkj4itMlvgfT13IUrD2lQb2pUuLgi87NRD3QXb+X+VyBxJiHrx0gRIe5 wLHXW/Ub0t+4AUHBSJYJPFWQIIXTrPkxIwaaucMOmmM2wKkPAJkfhYRUrULPp/oKpbog YaB4vIFoAT/e+2nkcqc1gnpdcKB3jDm5DmR4Q7unffJGrBpbtmS/50kefXM0vcA+I09I F6LQ==
X-Gm-Message-State: ALoCoQkn/5DgG4IzgePMWusxaz9mphDmXiJBKn3cF2fDUaP25glNAgcHdppTVSbJ6u02JcIIDunw
X-Received: by 10.70.40.164 with SMTP id y4mr706498pdk.25.1427924692256; Wed, 01 Apr 2015 14:44:52 -0700 (PDT)
Received: from [10.109.163.223] (mobile-166-171-250-075.mycingular.net. [166.171.250.75]) by mx.google.com with ESMTPSA id hk6sm3076242pdb.83.2015.04.01.14.44.50 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 01 Apr 2015 14:44:50 -0700 (PDT)
Content-Type: multipart/alternative; boundary="Apple-Mail-FC605D24-AD63-48CF-8D81-D5EE610E126C"
Mime-Version: 1.0 (1.0)
From: Jim Manico <jim@manico.net>
X-Mailer: iPhone Mail (12D508)
In-Reply-To: <B0E8A4F8-3D3C-44A1-B999-0B3E9034C00E@apple.com>
Date: Wed, 01 Apr 2015 14:44:49 -0700
Cc: "Eric Vyncke (evyncke)" <evyncke@cisco.com>, "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
Content-Transfer-Encoding: 7bit
Message-Id: <D666DA87-60FC-4DD7-B733-3855F5CEA190@manico.net>
References: <D141A3E5.4146E%evyncke@cisco.com> <B0E8A4F8-3D3C-44A1-B999-0B3E9034C00E@apple.com>
To: Michael Sweet <msweet@apple.com>
Received-SPF: none client-ip=209.85.192.177; envelope-from=jim@manico.net; helo=mail-pd0-f177.google.com
X-W3C-Hub-Spam-Status: No, score=-4.6
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: maggie.w3.org 1YdQRq-00031d-P5 c2c5f8eb983a9db7e98d291b6094a0b7
X-Original-To: ietf-http-wg@w3.org
Subject: Re: Linking a cookie to an IP address is a very bad in 2015...
Archived-At: <http://www.w3.org/mid/D666DA87-60FC-4DD7-B733-3855F5CEA190@manico.net>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/29202
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

Michael,

I manage the cheatsheet series for OWASP. If you think this should be changed hit me up off list at jim@owasp.org

Aloha,
--
Jim Manico
@Manicode
(808) 652-3805

> On Apr 1, 2015, at 1:13 PM, Michael Sweet <msweet@apple.com> wrote:
> 
> Here is the information our security guys rely on for best practices in web site session cookies:
> 
>     https://www.owasp.org/index.php/Session_Management_Cheat_Sheet
> 
> Client IP address is currently listed as one of the properties that can be used to bind the session ID to a specific client.
> 
> I'm not sure whether current PHP, etc. use the client IP or User Agent to validate the session ID...
> 
> 
>> On Apr 1, 2015, at 7:32 AM, Eric Vyncke (evyncke) <evyncke@cisco.com> wrote:
>> 
>> In the era of scarce IPv4 addresses, servers should NOT link the HTTP session cookies to the user-agent IP address...
>> 
>> I have posted in the IETF V6OPS WG the following:
>> http://www.ietf.org/proceedings/92/slides/slides-92-v6ops-6.pdf 
>> https://tools.ietf.org/html/draft-vyncke-v6ops-happy-eyeballs-cookie 
>> 
>> In short, heavy use of NAT and/or dual-stack (IPv4/IPv6) can cause a change of user-agent address => lost of session.
>> 
>> Any suggestion on how this can be addressed? I know at least two major web sites in Belgium that removed IPv6 from their web site due to this issue (and their security department not wanting to unlink IP address from the session cookies)
>> 
>> Comments are welcome
>> 
>> -éric
> 
> _________________________________________________________
> Michael Sweet, Senior Printing System Engineer, PWG Chair
>

v2.23.0 | Report a Bug | By Email