IETF Logo Mail Archive

Re: Linking a cookie to an IP address is a very bad in 2015...

Michael Sweet <msweet@apple.com> Wed, 01 April 2015 20:18 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13DF31A906C for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 1 Apr 2015 13:18:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.801
X-Spam-Level:
X-Spam-Status: No, score=-6.801 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OerLtmCW6ss6 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 1 Apr 2015 13:18:17 -0700 (PDT)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0EF5E1A1A3E for <httpbisa-archive-bis2Juki@lists.ietf.org>; Wed, 1 Apr 2015 13:18:17 -0700 (PDT)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1YdP26-0000Ct-IN for ietf-http-wg-dist@listhub.w3.org; Wed, 01 Apr 2015 20:14:38 +0000
Resent-Date: Wed, 01 Apr 2015 20:14:38 +0000
Resent-Message-Id: <E1YdP26-0000Ct-IN@frink.w3.org>
Received: from maggie.w3.org ([128.30.52.39]) by frink.w3.org with esmtp (Exim 4.80) (envelope-from <msweet@apple.com>) id 1YdP23-0000A1-3D for ietf-http-wg@listhub.w3.org; Wed, 01 Apr 2015 20:14:35 +0000
Received: from mail-out6.apple.com ([17.151.62.28] helo=mail-in6.apple.com) by maggie.w3.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.72) (envelope-from <msweet@apple.com>) id 1YdP21-000077-Tm for ietf-http-wg@w3.org; Wed, 01 Apr 2015 20:14:35 +0000
DKIM-Signature: v=1; a=rsa-sha256; d=apple.com; s=mailout2048s; c=relaxed/simple; q=dns/txt; i=@apple.com; t=1427919245; x=2291832845; h=From:Sender:Reply-To:Subject:Date:Message-id:To:Cc:MIME-version:Content-type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-reply-to:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=JZkp/U3IqZtaftX3Lazwciq+FEjsXFfqAzN8W9tYEKU=; b=KMNzEZgm3kikkVLliFB/XFrBsbwbxb6VKUnRbPQ3xcQOb8Ny1Haukfb8ySGemx7q Ohsd28ReRTKZOOSxiJ/tR8CLNXfoquV0AfvA7TJz+ADPET/k6tfQHcTOYY1+HEDw 8P801/9m0Oik2yRMRelY2PhG26hnBI7q23KvC/7qni1oKJzRILMPnFB5GqdLAAUi HsUpo5zADMYPRRcpcP+pfqfPYLAcAMRwQ1DaxeugKnoYg+6CdDga47+vFPLrCdxy jRLJwpyfROC3f8M65Jf+Hkvt38f8ifQOkH7piNmBP4WX1dJ/WhWvpjN5BGZwBBHN 7ZHCWVm9XXkJmR0IA1iJ5Q==;
Received: from relay3.apple.com (relay3.apple.com [17.128.113.83]) by mail-in6.apple.com (Apple Secure Mail Relay) with SMTP id 53.B0.09025.D815C155; Wed, 1 Apr 2015 13:14:05 -0700 (PDT)
X-AuditID: 11973e15-f79fd6d000002341-04-551c518d0b55
Received: from marigold.apple.com (marigold.apple.com [17.128.115.132]) (using TLS with cipher RC4-MD5 (128/128 bits)) (Client did not present a certificate) by relay3.apple.com (Apple SCV relay) with SMTP id 31.7A.19589.4915C155; Wed, 1 Apr 2015 13:14:12 -0700 (PDT)
Received: from [17.153.22.176] by marigold.apple.com (Oracle Communications Messaging Server 7.0.5.30.0 64bit (built Oct 22 2013)) with ESMTPSA id <0NM500MPG9J9T550@marigold.apple.com> for ietf-http-wg@w3.org; Wed, 01 Apr 2015 13:14:05 -0700 (PDT)
MIME-version: 1.0 (Mac OS X Mail 8.2 \(2095\))
Content-type: multipart/alternative; boundary="Apple-Mail=_6531AD06-DDA8-47B8-9487-9A8032B29A71"
From: Michael Sweet <msweet@apple.com>
In-reply-to: <D141A3E5.4146E%evyncke@cisco.com>
Date: Wed, 01 Apr 2015 16:13:57 -0400
Cc: "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
Message-id: <B0E8A4F8-3D3C-44A1-B999-0B3E9034C00E@apple.com>
References: <D141A3E5.4146E%evyncke@cisco.com>
To: "Eric Vyncke (evyncke)" <evyncke@cisco.com>
X-Mailer: Apple Mail (2.2095)
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrJLMWRmVeSWpSXmKPExsUi2FAYrNsbKBNqcG2/jMXhlllMDoweR+ft Zw1gjOKySUnNySxLLdK3S+DK+N74g71gtkFFw9wWtgbGiVpdjBwcEgImEu9P83QxcgKZYhIX 7q1n62Lk4hAS2Mso0fJvGxNEwkRi+ufDLBCJSUwSc3fOZIdw/jJKzPh6nhmkSljAXeL3iplg Nq+AnsSjljMsIDazQJLEi95tYDabgJrE70l9rCA2p4C+xLGF98FsFgFViSO7n0LV60v8378T ao6NxKe5X9hBbCGgmfu3XmAEuVoEqGbdghiI42Qleo/PZwa5R0LgJ6vEtO1HWCcwCs1CcsYs JGdA2NoSyxa+Zoaw9SReNr1jxxTXlbi4bhLjAka2VYxCuYmZObqZeWZ6iQUFOal6yfm5mxhB YT/dTnQH45lVVocYBTgYlXh4b9jKhAqxJpYVV+YeYpTmYFES502Qlg4VEkhPLEnNTk0tSC2K LyrNSS0+xMjEwSnVwPiMaVrsIYOUnF3zz7jNvHfC+K73+ml3WWdYrVRf/Crvl8An3u3tiabx RWYvE9M+PJ1zYmXnJZ/zM7qDZ55cnKAUWz7JXuF1GUddqvJygZqMZmXHBWZs35td23WUNsza WG4+3Z37ev7lkwWOmbyygmusn0S5ibCsSLSZkmc2W+BQz83Tq9ZUTFBiKc5INNRiLipOBACl GmwTXAIAAA==
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrLLMWRmVeSWpSXmKPExsUi2FDcojslUCbUoOumkcXhlllMDoweR+ft Zw1gjOKySUnNySxLLdK3S+DK+N74g71gtkFFw9wWtgbGiVpdjJwcEgImEtM/H2aBsMUkLtxb z9bFyMUhJDCJSWLuzpnsEM5fRokZX88zg1QJC7hL/F4xE8zmFdCTeNRyBqybWSBJ4kXvNjCb TUBN4vekPlYQm1NAX+LYwvtgNouAqsSR3U+h6vUl/u/fCTXHRuLT3C/sILYQ0Mz9Wy8wdjFy cIgA1axbEANxnKxE7/H5zBMY+Wch2TwLyWYIW1ti2cLXzBC2nsTLpnfsmOK6EhfXTWJcwMi2 ilGgKDUnsdJYL7GgICdVLzk/dxMjOFALg3cw/llmdYhRgINRiYe3IUo6VIg1say4MvcQowQH s5IIr6SITKgQb0piZVVqUX58UWlOavEhRmkOFiVx3jw5oGqB9MSS1OzU1ILUIpgsEwenVANj dXuhrz3P1lk2v5zTffL0Zf0K2S7OivivrPPx8ZOfFzxXn1OKkd586YSr4p219wQ05xy0KWgp /pDo/Df3ij274P2FC1azbLK4POWn+u2XXrtT1y+YXX24pinoRFkRyxG7Wf9f50Rt2Jbz4KfM 8njn2gWyjzTS3t9dmpjdOmvl85t2F6z6AwOnKbEUZyQaajEXFScCAL12LPtQAgAA
Received-SPF: pass client-ip=17.151.62.28; envelope-from=msweet@apple.com; helo=mail-in6.apple.com
X-W3C-Hub-Spam-Status: No, score=-6.7
X-W3C-Hub-Spam-Report: AWL=0.563, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, W3C_AA=-1, W3C_DB=-1, W3C_WL=-1
X-W3C-Scan-Sig: maggie.w3.org 1YdP21-000077-Tm ea862dcbaa35d860b3ed19f0b462e191
X-Original-To: ietf-http-wg@w3.org
Subject: Re: Linking a cookie to an IP address is a very bad in 2015...
Archived-At: <http://www.w3.org/mid/B0E8A4F8-3D3C-44A1-B999-0B3E9034C00E@apple.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/29199
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

Here is the information our security guys rely on for best practices in web site session cookies:

    https://www.owasp.org/index.php/Session_Management_Cheat_Sheet <https://www.owasp.org/index.php/Session_Management_Cheat_Sheet>

Client IP address is currently listed as one of the properties that can be used to bind the session ID to a specific client.

I'm not sure whether current PHP, etc. use the client IP or User Agent to validate the session ID...


> On Apr 1, 2015, at 7:32 AM, Eric Vyncke (evyncke) <evyncke@cisco.com> wrote:
> 
> In the era of scarce IPv4 addresses, servers should NOT link the HTTP session cookies to the user-agent IP address...
> 
> I have posted in the IETF V6OPS WG the following:
> http://www.ietf.org/proceedings/92/slides/slides-92-v6ops-6.pdf <http://www.ietf.org/proceedings/92/slides/slides-92-v6ops-6.pdf> 
> https://tools.ietf.org/html/draft-vyncke-v6ops-happy-eyeballs-cookie <https://tools.ietf.org/html/draft-vyncke-v6ops-happy-eyeballs-cookie> 
> 
> In short, heavy use of NAT and/or dual-stack (IPv4/IPv6) can cause a change of user-agent address => lost of session.
> 
> Any suggestion on how this can be addressed? I know at least two major web sites in Belgium that removed IPv6 from their web site due to this issue (and their security department not wanting to unlink IP address from the session cookies)
> 
> Comments are welcome
> 
> -éric
> 

_________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair

v2.23.0 | Report a Bug | By Email