logo

Database

Insecure Object Reference - Session Management

Need

To prevent unauthorized users from closing sessions of other users

Context

• Usage of Elixir 1.12 for building scalable and fault-tolerant applications

• Usage of Phoenix Framework 1.6 for web development

Description

1. Non compliant code

defmodule SessionManager do
  def logout_user(conn, email) do
    # Clearing the session
    conn
    |> put_flash(:info, "Logged out successfully.")
    |> configure_session(drop: true)
    |> redirect(to: "/")
end...

In this insecure code, the `logout_user` function logs out a user based on the email provided. This is insecure because if an attacker knows a user's email, they can log out the user's session.

2. Steps

• Use a secure identifier, like a session token, to identify the user for the logout operation

• Implement checks to validate that the session being terminated matches the user performing the operation

3. Secure code example

defmodule SessionManager do
  def logout_user(conn, session_token) do
    user = get_user_from_session_token(session_token)
    if conn.assigns.current_user == user do
      # Clearing the session
      conn
      |> put_flash(:info, "Logged out successfully.")
      |> redirect(to: "/")...

In the secure version of the code, the system checks whether the session being terminated belongs to the user initiating the logout operation.