14 ms·
>You are not saving anything there. A session should really only contain user id. This is all ours do. I'm not totally clear on where the actual security issue
by heretohelp 14y ago
>You are not saving anything there. A session should really only contain user id.
This is all ours do. I'm not totally clear on where the actual security issue is here. Adding a level of indirection to a backend store doesn't seem like it would change much.
- jerf 14y agoI don't have access to Flask or the ability to answer this question in any reasonable amount of time, so I'm asking. If your session has the user id, what format is the user id in? Is it the email address, or goodness forbid, an autoincremented numeric ID? Or anything else even remotely guessable? If so, you've still got a problem. Obscuring through an opaque token of suitable entropy means that it is effectively impossible to guess a valid token. Accepting the client's idea of who the user is is playing with fire.
- nezza-_- 14y agoFlask doesn't have its own user system, in the wild one sees stuff like user-ids and so on. It makes it very easy to make bad mistakes.
- heretohelp 14y agoIt's a MongoDB objectid. It's guessable. Still not seeing the problem yet, as you haven't bothered to explain it.
- gnaritas 14y agoSo what stops me from changing the user ID cookie to another user and impersonating them?
- daeken 14y agoThe HMAC authenticating the cookie.
- gnaritas 14y agoSo it is a secure cookie, that wasn't clear.
- heretohelp 14y agoSo going back to my original question, does this mean I have nothing to worry about?
- gnaritas 14y agoI won't dare give security advice with all the security professionals lurking around here.
- heretohelp 14y agoK, falling back to my "not giving a fuck" mode I was in before and assuming any compromises of the session would involve access to my backend servers which is worse than losing control of the sessions.