[Zope-Coders] Re: [Zope-Checkins] CVS: Zope/lib/python/Products/Sessions/stresstests - stresstestMultiThread.py:1.5

[Casey Duncan]

Perhaps this issue should be prominently documented. The main reason for =
this=20
being useful is that some sites do not want to use cookies, and yet want=20
sessions for anonymous users. Query strings are a pain to keep floating=20
around, so this solution makes it relatively easy since the actual pages =
can=20
be blissfully ignorant of the extra entropy in the URL.

Anyway that is a very useful piece of info about sniffing the referer for=
=20
session info.

-Casey

On Wednesday 21 August 2002 09:24 am, Florent Guillaume wrote:
> Chris McDonough  <chrism@zope.com> wrote:
> > Added the capability for browser ids to be encoded in URLs.
> >=20
> > When a set of knobs is set on the browser_id_manager "settings" scree=
n,
> > ("look for browser id name in..." and 'automatically encode browser=20
ids..."),
> > a traversal hook is installed in the browser id manager's container w=
hich
> > causes a) the request to be searched for a browser id name and a brow=
ser
> > id as the first two elements of the URL path and b) for Zope-generate=
d=20
URLs
> > to contain these path elements.
> >=20
> > Various documentation and interface updates.  No interface methods
> > were harmed in the filming of this checkin, but a few were added or=20
extended
> > with defaults.
>=20
>=20
> This is a quite useful feature, but at the same time a very dangerous
> one security-wise.
>=20
> The problem is that now any an external site that's linked from a site
> using this feature will receive as a Referer all your session
> information. I know that sessions aren't supposed to be used for
> authentication, but I'm not sure everyone will comply, and also in the
> case of anonymous users you're doomed.
>=20
> This kind of bug was prevalent in a huge number of webmail applications
> until recently: you only had to send a mail to someone with in it a lin=
k
> to a site whose logs you could read, and voil=E0, you had their full
> authentication (because they were stored as session in the URL).
>=20
> Florent
>=20
> --=20
> Florent Guillaume, Nuxeo (Paris, France)
> +33 1 40 33 79 87  http://nuxeo.com  mailto:fg@nuxeo.com
>=20
> _______________________________________________
> Zope-Coders mailing list
> Zope-Coders@zope.org
> http://lists.zope.org/mailman/listinfo/zope-coders
>=20