Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I currently have built a system that checks user IP, browser, and a random-string cookie to determine if he is an admin.
In the worst case, someone steals my cookie, uses the same browser I do, and masks his IP to appear as mine. Is there another layer of security I should add onto my script to make it more secure?
EDIT: To clarify: my website accepts absolutely NO input from users. I’m just designing a back-end admin panel to make it easier to update database entries.
Checking the browser is a complete and absolute waste of code. There is no point in writing a secuirty system that is trivial for an attacker to bypass. If the attacker obtains the session id via xss or sniffing the line then they will also have your “user-agent”.
Checking the ip address will force the attacker to “ride” on the session with XSS+XHR or XSRF. This is because the hijacked token will not work on his box. Unfortunately this also causes problems for corporate networks which use outgoing load balancing between multiple ip addresses.
HTTPS is a must be used for the entire session. At no point can your token be sent over HTTP. This is clearly layed out in “Broken Authentication and Session Management” in The OWASP Top 10 for 2010, which you absolutely must read if you are writing a session handler.
Session id’s must always time out. If they do not then this is called an immortal session, which is a recognized vulnerability.
Further more i am concerned about the randomness of your token. Make sure your study how to properly generate a cryptographic nonce. Make sure your random number generator is strong and seeded with information that an attacker cannot know.
I also suspect that you haven’t taken XSS and XSRF into consideration. It doesn’t matter how strong you make your session in other areas if you leave a major vulnerability unchecked. Make sure you scan your application using a free xss scanner or the open source wapiti. Keep in mind that no test will accurately detect XSRF and every single request in your application is vulnerable unless you specifically patch it.