Is the way i do, secure enought to avoid session hijacking

[Hope Paka]

I am storing user login information (not password) in the session. I also
use, cookieless session. I realized that, if someone copy-pastes the URL
after he/she logged in to the system to another person, the other person's
browser opens as if the sender logged in.

1) Person A Logins to the system. (login information is stored in SQL
Session state)

2) Person A copy-paster the url and sends it to person B (format of the
url is http://domain/(sessionid)/XYZ.aspx)

3) When person B opens the URL, its window opens as if person A was
logged in to the system.

This is a security threat. I have overcome this by doing the following.

When user logins to the system, a login ticket is generated and
it is stored in the session. This login ticket contains two things, one is
client ip address, the other one is user-agent.

Then at the each request, I validate if the registered login ticket
information is same.

If person A sends URL to person B, then I assumed that, person Bs ip address
should be different than person A.

I found an article on MSND,
http://msdn.microsoft.com/msdnmag/is...08/WickedCode/ (Foiling Session
Hijacking Attempts). The way Jeff have done is similar to the one that i
have done. Is this relaible. The only think i wonder is if the users IP
address changes at each request!

[Kevin Spencer]

Hi Hope,

Your method looks pretty sound to me. The client's IP address cannot change
between requests. It is, after all, the "return address" for the client's
HTTP messages.

--
HTH,

Kevin Spencer
Microsoft MVP
..Net Developer
Sometimes you eat the elephant.
Sometimes the elephant eats you.

"Hope Paka" <ut*******@hotm ail.com> wrote in message
news:es******** ******@TK2MSFTN GP09.phx.gbl...

I am storing user login information (not password) in the session. I also
use, cookieless session. I realized that, if someone copy-pastes the URL
after he/she logged in to the system to another person, the other person's
browser opens as if the sender logged in.

1) Person A Logins to the system. (login information is stored in SQL
Session state)

2) Person A copy-paster the url and sends it to person B (format of
the url is http://domain/(sessionid)/XYZ.aspx)

3) When person B opens the URL, its window opens as if person A was
logged in to the system.

This is a security threat. I have overcome this by doing the following.

When user logins to the system, a login ticket is generated and
it is stored in the session. This login ticket contains two things, one is
client ip address, the other one is user-agent.

Then at the each request, I validate if the registered login ticket
information is same.

If person A sends URL to person B, then I assumed that, person Bs ip
address should be different than person A.

I found an article on MSND,
http://msdn.microsoft.com/msdnmag/is...08/WickedCode/ (Foiling
Session Hijacking Attempts). The way Jeff have done is similar to the one
that i have done. Is this relaible. The only think i wonder is if the
users IP address changes at each request!

[Phillip Ian]

Have you considered routers that do NAT? If I'm not mistaken, requests
from different computers here on our corporate network will appear to
come from the same IP, so if I email a link to a co-worker, they might
end up with my session.

Just a thought.

-Phil

[Hope Paka]

You are exactly right Philip?
Then the only remaining part is the validation of the user-agent. But
probably, your co-worker have a same browser and machine configuration with
you. This is a real problem but this couldn't be only my problem. How this
stateless word can be done more secure??
I thought only IP and user-agents are specific to clients, are there any
other third parameter?

"Phillip Ian" <ph****@comcast .net> wrote in message
news:11******** ************@g4 4g2000cwa.googl egroups.com...

Have you considered routers that do NAT? If I'm not mistaken, requests
from different computers here on our corporate network will appear to
come from the same IP, so if I email a link to a co-worker, they might
end up with my session.

Just a thought.

-Phil

[Kevin Spencer]

Good thinking, Phil. I hadn't considered that. Still, I believe the NAT must
keep track of the IP address of the originating computer as well, but I'm
starting to venture outside of my area of expertise here.

--
HTH,

Kevin Spencer
Microsoft MVP
..Net Developer
Sometimes you eat the elephant.
Sometimes the elephant eats you.

"Phillip Ian" <ph****@comcast .net> wrote in message
news:11******** ************@g4 4g2000cwa.googl egroups.com...

Have you considered routers that do NAT? If I'm not mistaken, requests
from different computers here on our corporate network will appear to
come from the same IP, so if I email a link to a co-worker, they might
end up with my session.

Just a thought.

-Phil

[gerry]

are you sure about that ?
from what I have read about AOL proxies and what i see in my IIS logs - it
seems that this is not true and that there can be multiple ip's for a single
client within a session.
i don't have the asp.net session id in the log files so i can't be 100%
certain.
Gerry

"Kevin Spencer" <ke***@DIESPAMM ERSDIEtakempis. com> wrote in message
news:OL******** ******@TK2MSFTN GP15.phx.gbl...

Hi Hope,

Your method looks pretty sound to me. The client's IP address cannot change between requests. It is, after all, the "return address" for the client's
HTTP messages.

--
HTH,

Kevin Spencer
Microsoft MVP
.Net Developer
Sometimes you eat the elephant.
Sometimes the elephant eats you.

"Hope Paka" <ut*******@hotm ail.com> wrote in message
news:es******** ******@TK2MSFTN GP09.phx.gbl...

I am storing user login information (not password) in the session. I also
use, cookieless session. I realized that, if someone copy-pastes the URL
after he/she logged in to the system to another person, the other person'sbrowser opens as if the sender logged in.

1) Person A Logins to the system. (login information is stored in SQL Session state)

2) Person A copy-paster the url and sends it to person B (format of
the url is http://domain/(sessionid)/XYZ.aspx)

3) When person B opens the URL, its window opens as if person A was
logged in to the system.

This is a security threat. I have overcome this by doing the following.

When user logins to the system, a login ticket is generated and it is stored in the session. This login ticket contains two things, one is client ip address, the other one is user-agent.

Then at the each request, I validate if the registered login ticket
information is same.

If person A sends URL to person B, then I assumed that, person Bs ip
address should be different than person A.

I found an article on MSND,
http://msdn.microsoft.com/msdnmag/is...08/WickedCode/ (Foiling
Session Hijacking Attempts). The way Jeff have done is similar to the one that i have done. Is this relaible. The only think i wonder is if the
users IP address changes at each request!

[Phillip Ian]

Like Kevin, I'm stepping just outside my realm of knowledge, but
perhaps someone else can confirm this for us...

I understand that the way NAT works is to send all the requests from
one IP address, but using different port #s, so that it can tel that
responses on port 6346 are really meant for the machine at IP such and
such on port such and such.

At the server, we must know what port we are responding to, no? Then,
requests from two machines on the same network with the same IP will
still have to have different ports. According to what I see, it is in
Request.ServerV ariables("REMOT E_PORT")

[Kevin Spencer]

Within the AOL LAN, IP addresses are assigned on a per-client-session basis,
if I'm not mistaken (at least with dial-up connections). But again, this is
not my area of expertise. Still, I understand quite a bit about networks,
and I can't imagine why an IP address of a machine inside a network would
change within the same client session. It is, again, the "return address" of
the computer on the network.

--
HTH,

Kevin Spencer
Microsoft MVP
..Net Developer
Sometimes you eat the elephant.
Sometimes the elephant eats you.

"gerry" <ge**@hotmail.c om> wrote in message
news:Oc******** ******@TK2MSFTN GP14.phx.gbl...

are you sure about that ?
from what I have read about AOL proxies and what i see in my IIS logs - it
seems that this is not true and that there can be multiple ip's for a
single
client within a session.
i don't have the asp.net session id in the log files so i can't be 100%
certain.
Gerry

"Kevin Spencer" <ke***@DIESPAMM ERSDIEtakempis. com> wrote in message
news:OL******** ******@TK2MSFTN GP15.phx.gbl...

Hi Hope,

Your method looks pretty sound to me. The client's IP address cannot

change

between requests. It is, after all, the "return address" for the client's
HTTP messages.

--
HTH,

Kevin Spencer
Microsoft MVP
.Net Developer
Sometimes you eat the elephant.
Sometimes the elephant eats you.

"Hope Paka" <ut*******@hotm ail.com> wrote in message
news:es******** ******@TK2MSFTN GP09.phx.gbl...

>I am storing user login information (not password) in the session. I
>also
>use, cookieless session. I realized that, if someone copy-pastes the URL
>after he/she logged in to the system to another person, the other person's >browser opens as if the sender logged in.
>
> 1) Person A Logins to the system. (login information is stored in SQL > Session state)
>
> 2) Person A copy-paster the url and sends it to person B (format
> of
> the url is http://domain/(sessionid)/XYZ.aspx)
>
> 3) When person B opens the URL, its window opens as if person A
> was
> logged in to the system.
>
> This is a security threat. I have overcome this by doing the following.
>
> When user logins to the system, a login ticket is generated and > it is stored in the session. This login ticket contains two things, one is > client ip address, the other one is user-agent.
>
> Then at the each request, I validate if the registered login ticket
> information is same.
>
> If person A sends URL to person B, then I assumed that, person Bs ip
> address should be different than person A.
>
> I found an article on MSND,
> http://msdn.microsoft.com/msdnmag/is...08/WickedCode/ (Foiling
> Session Hijacking Attempts). The way Jeff have done is similar to the one > that i have done. Is this relaible. The only think i wonder is if the
> users IP address changes at each request!
>
>

[Marina]

What about this:

If you make sure that the only way users navigate from page to page is via
posts, then you can require that all your pages send the sessionid as a post
variable. So just check that.
Or alternatively you can store some GUID in session, and also pass it around
as a post variable. And then check that what got posted, is the same thing
you are storing in session.

The person who cut and pasted the URL, is going to be getting the URL as a
GET, not a POST, so you will know it is someone else.

I know it's not an ideal solution, as you have to change the mechanism of
the way navigation takes place on your site, but I think it may work.

"Hope Paka" <ut*******@hotm ail.com> wrote in message
news:es******** ******@TK2MSFTN GP09.phx.gbl...

I am storing user login information (not password) in the session. I also
use, cookieless session. I realized that, if someone copy-pastes the URL
after he/she logged in to the system to another person, the other person's
browser opens as if the sender logged in.

1) Person A Logins to the system. (login information is stored in SQL
Session state)

2) Person A copy-paster the url and sends it to person B (format of
the url is http://domain/(sessionid)/XYZ.aspx)

3) When person B opens the URL, its window opens as if person A was
logged in to the system.

This is a security threat. I have overcome this by doing the following.

When user logins to the system, a login ticket is generated and
it is stored in the session. This login ticket contains two things, one is
client ip address, the other one is user-agent.

Then at the each request, I validate if the registered login ticket
information is same.

If person A sends URL to person B, then I assumed that, person Bs ip
address should be different than person A.

I found an article on MSND,
http://msdn.microsoft.com/msdnmag/is...08/WickedCode/ (Foiling
Session Hijacking Attempts). The way Jeff have done is similar to the one
that i have done. Is this relaible. The only think i wonder is if the
users IP address changes at each request!

[Phillip Ian]

Well, that just blows using IP address in any form right out of the
water. :)

Too bad they don't pass us the processor serial number or somesuch on a
request.