Question

From a recent audit of our Plone 4.01 instance:

1. Where possible encrypt the username stored in the session cookie, or use the one-time session ID to identify the user (at the server end) instead of the username.

   • The usernames were stored in the applications session cookie using base64 encoding, which can be easily decoded.

2. Invalidate the session ID immediately when the user logs out.

   • When logging out of the PLONE application, the application deletes the cookie, however does not invalidate the user session ID. It was also noted that authenticating with the application a second time did not invalidate previous session cookies.

We would prefer not to add another product to the stack to resolve these findings if possible.

Btw we do have Beaker installed and this is being used for public accounts as part of the ecommerce area of the site, whereas the content admins/authors are using the standard Plone login/security mechanism which is what is drawing the audit findings… perhaps Beaker can be reused for the content authors as well? Not sure if this is a good idea though…

Btw we are also updating to Plone 4.2 soonish.

Answer 1

If you are concerned with cookie security, you should always use SSL encryption. The same username is included in the page output, for example, so the fact that it’s included in the cookie as well isn’t a information leak as such.

The cookie uses a cryptographic hash that has a limited timespan, the default is 12 hours, after which the cookie will no longer be accepted.

You can lower this timeout:

1. go to the ZMI of your plone instance

2. Find the acl_users folder, then the session plugin:

   

3. Go to the Properties tab (right-most tab)

4. Change the “Cookie validity timeout (in seconds)” property to a new value.

Take note of the “Refresh interval (in seconds, -1 to disable refresh)” value below it though; whenever the signed cookie is older than the refresh interval, a new cookie is generated, to refresh the cookie lifetime. So, by default, once every hour, you are issued a new cookie that is valid for 12 hours.

You don’t want your cookie validity timeout to fall below the refresh interval. If you set these values very low, you may want to think about using a periodic AJAX ‘ping’ request to keep the cookie fresh while the user is still using the site.

In fact, plone.session already includes a facility to implement this ping for you. Simply enable it by installing the “Session refresh support” add-on in the control panel (“Site setup” > “Add-ons” > check “Session refresh support 3.5”, click “Activate”). This will install the javascript library for you, and it’ll ping the server every 5 minutes, provided there has been some mouse or keyboard activity while the current page is loaded.