Re: Linking a cookie to an IP address is a very bad in 2015...

Here is the information our security guys rely on for best practices in web site session cookies:

    https://www.owasp.org/index.php/Session_Management_Cheat_Sheet <https://www.owasp.org/index.php/Session_Management_Cheat_Sheet>

Client IP address is currently listed as one of the properties that can be used to bind the session ID to a specific client.

I'm not sure whether current PHP, etc. use the client IP or User Agent to validate the session ID...


> On Apr 1, 2015, at 7:32 AM, Eric Vyncke (evyncke) <evyncke@cisco.com> wrote:
> 
> In the era of scarce IPv4 addresses, servers should NOT link the HTTP session cookies to the user-agent IP address...
> 
> I have posted in the IETF V6OPS WG the following:
> http://www.ietf.org/proceedings/92/slides/slides-92-v6ops-6.pdf <http://www.ietf.org/proceedings/92/slides/slides-92-v6ops-6.pdf> 
> https://tools.ietf.org/html/draft-vyncke-v6ops-happy-eyeballs-cookie <https://tools.ietf.org/html/draft-vyncke-v6ops-happy-eyeballs-cookie> 
> 
> In short, heavy use of NAT and/or dual-stack (IPv4/IPv6) can cause a change of user-agent address => lost of session.
> 
> Any suggestion on how this can be addressed? I know at least two major web sites in Belgium that removed IPv6 from their web site due to this issue (and their security department not wanting to unlink IP address from the session cookies)
> 
> Comments are welcome
> 
> -éric
> 

_________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair