Is Session secure?

[cx42net]

Hi!

While working a Play! project, I looked at the existing cookies Play!
generated.

As I was expecting, I saw a cookie dedicated to the session (with a
session ID) but what struck me was the fact that all the other
information normally stored in the session were also in that cookies
(a session.put ("key", value) would be visible in the cookie as
key=value&etc..)

Is it possible to change these values directly from the cookie ? or is
there a test that is made against, say, the session ID to verify that
data aren't been changed from the browser ?

Thanks for the reply!

[David Wursteisen]

the cookie is signed. It will be invalidated if you change any data
http://www.playframework.org/documentation/1.0/controllers#session

2011/4/4 cx42net <cx4...@gmail.com>

--
You received this message because you are subscribed to the Google Groups "play-framework" group.
To post to this group, send email to play-fr...@googlegroups.com.
To unsubscribe from this group, send email to play-framewor...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/play-framework?hl=en.

[cx42net]

That is all I wanted to ear! Thanks!

On 4 avr, 15:24, David Wursteisen <david.wurstei...@gmail.com> wrote:
> the cookie is signed. It will be invalidated if you change any datahttp://www.playframework.org/documentation/1.0/controllers#session
>

> 2011/4/4 cx42net <cx42...@gmail.com>

[Ivan San José García]

Session cookie is signed with your application secret. If anyone change the contents of this cookie, the sign will not match, and Play! ignores this request automatically

[王宜国]

i used play session in my restfull api server, if some one copy the cookie from client A to another client B, is it validate? 

在 2011年4月4日星期一UTC+8下午9时29分49秒，ivansjg写道：

[Will Sargent]

You are still open to replay attacks, if that's what you mean.  You can protect against it by storing some state on the server.   http://jaspan.com/improved_persistent_login_cookie_best_practice

More generally, you should only store the session ID in the cookie, and then pull session data from a key / value store you control.

http://guides.rubyonrails.org/security.html#replay-attacks-for-cookiestore-sessions

http://www.troyhunt.com/2010/07/owasp-top-10-for-net-developers-part-3.html

Will Sargent

Consultant, Professional Services

Typesafe, the company behind Play Framework, Akka and Scala

To unsubscribe from this group and stop receiving emails from it, send an email to play-framewor...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.