Re: Check the cookie for changes

The session ids that I'm using here are those generated by Apache::Session itself. They appear to be a md5 hash of some sort (I've not really looked into *how* they are generated). That's the only piece of info ever stored in a cookie, and validating if the cookie has been tinkered with is easy.

eval {
    # tie to session_id (sorry it's monday morning don't remember the 
+exact syntax)
}
if ($@) {
    print "bogus session\n";
}
[download]

basically if you ask apache session to access a session that doesn't exist it dies. Thus the eval...

/\/\averick
perl -l -e "eval pack('h*','072796e6470272f2c5f2c5166756279636b672');"

Comment on Re: Check the cookie for changes Download Code

Replies are listed 'Best First'.
Re: Re: Check the cookie for changes by drewbie (Chaplain) on Mar 25, 2002 at 16:02 UTC
True, that would work fine if all you're storing in the cookie is the session id. I usually put a little more in the cookie than just the id, so using a hash to verify the value I put there is second nature to me. Here's a scenario: User A get a cookie w/ the session and logs into a web app w/ sensitive data. User B has access to User A's computer (hacker, social engineering, etc) and gets the session ID. User B then creates a session cookie like User A's, and now he can see the sensitive data he should not have access to. Using a checksum on the cookie value can help to avoid situations like this. And there really is not a downside. You write the code once, it uses C based modules so it's fast, and you prevent one less possible security problem. Maybe you'll never run across this situation, but should you do so you don't have to worry. Just a thought...	[reply]
Re: Re: Check the cookie for changes by belg4mit (Prior) on Mar 28, 2002 at 02:05 UTC
The default, Apache::Session::Generate::MD5, does `MD5->hexhash(time(). {}. rand(). $$)`/ Systems such as ASP under IIS appear to have session ID's that are partially determined by the client headers the (User-agent, Accept, etc.) PS> I was horrified re-reading the Apache::Session documentation that in the SYNOPSIS they place a cc number in the session data. `-- perl -pe "s/\b;([st])/'\1/mg"`	[reply] [d/l]