- From: Jim Manico <jim@manico.net>
- Date: Wed, 1 Apr 2015 14:44:49 -0700
- To: Michael Sweet <msweet@apple.com>
- Cc: "Eric Vyncke (evyncke)" <evyncke@cisco.com>, "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
- Message-Id: <D666DA87-60FC-4DD7-B733-3855F5CEA190@manico.net>
Michael, I manage the cheatsheet series for OWASP. If you think this should be changed hit me up off list at jim@owasp.org Aloha, -- Jim Manico @Manicode (808) 652-3805 > On Apr 1, 2015, at 1:13 PM, Michael Sweet <msweet@apple.com> wrote: > > Here is the information our security guys rely on for best practices in web site session cookies: > > https://www.owasp.org/index.php/Session_Management_Cheat_Sheet > > Client IP address is currently listed as one of the properties that can be used to bind the session ID to a specific client. > > I'm not sure whether current PHP, etc. use the client IP or User Agent to validate the session ID... > > >> On Apr 1, 2015, at 7:32 AM, Eric Vyncke (evyncke) <evyncke@cisco.com> wrote: >> >> In the era of scarce IPv4 addresses, servers should NOT link the HTTP session cookies to the user-agent IP address... >> >> I have posted in the IETF V6OPS WG the following: >> http://www.ietf.org/proceedings/92/slides/slides-92-v6ops-6.pdf >> https://tools.ietf.org/html/draft-vyncke-v6ops-happy-eyeballs-cookie >> >> In short, heavy use of NAT and/or dual-stack (IPv4/IPv6) can cause a change of user-agent address => lost of session. >> >> Any suggestion on how this can be addressed? I know at least two major web sites in Belgium that removed IPv6 from their web site due to this issue (and their security department not wanting to unlink IP address from the session cookies) >> >> Comments are welcome >> >> -éric > > _________________________________________________________ > Michael Sweet, Senior Printing System Engineer, PWG Chair >
Received on Wednesday, 1 April 2015 21:45:20 UTC