[Zope-Coders] Re: [Zope-Checkins] CVS: Zope/lib/python/Products/Sessions/stresstests - stresstestMultiThread.py:1.5

[Florent Guillaume]

Chris McDonough  <chrism@zope.com> wrote:
> Added the capability for browser ids to be encoded in URLs.
> 
> When a set of knobs is set on the browser_id_manager "settings" screen,
> ("look for browser id name in..." and 'automatically encode browser ids..."),
> a traversal hook is installed in the browser id manager's container which
> causes a) the request to be searched for a browser id name and a browser
> id as the first two elements of the URL path and b) for Zope-generated URLs
> to contain these path elements.
> 
> Various documentation and interface updates.  No interface methods
> were harmed in the filming of this checkin, but a few were added or extended
> with defaults.


This is a quite useful feature, but at the same time a very dangerous
one security-wise.

The problem is that now any an external site that's linked from a site
using this feature will receive as a Referer all your session
information. I know that sessions aren't supposed to be used for
authentication, but I'm not sure everyone will comply, and also in the
case of anonymous users you're doomed.

This kind of bug was prevalent in a huge number of webmail applications
until recently: you only had to send a mail to someone with in it a link
to a site whose logs you could read, and voilą, you had their full
authentication (because they were stored as session in the URL).

Florent

-- 
Florent Guillaume, Nuxeo (Paris, France)
+33 1 40 33 79 87  http://nuxeo.com  mailto:fg@nuxeo.com