RE: Security Proposal

This message was sent from: Development
http://forums.oscommerce.com/viewtopic.php?p=164873#164873
----------------------------------------------------------------

[quote]I understand your fear of sessions being hyacked. I wonder, however, how the scenario from the quote would take place. Can you give a practical example of how a malicious site could fetch the osc-cookie?
[/quote]

I believe someone a few pages back went into a lot of details about malicious web hosts and shared hosts.  I myself am not trying to either lend credibility to or deny the credibility of the proposed threat, I simply don't know. If people have experienced this threat I speculate their must be some small possibility of it.  It isnt clear to me how a website can steal cookies on a PC that were created by another website, but people keep claiming it can be done.   

[quote]The lifetime of the sessioncookie is set to end-of-session. This means that the cookie is destroyed as soon as the last browserwindow is closed. 
[/quote]
I dont know how typical I am, but my computer is usually rebooted only once or twice a year, and I log off my main account maybe 5 times a year, and I rarely if ever close my browsers.  I just unplug from the wall when I am not in front of the computer. So these cookies can last for weeks.  BUT y'know, thats not really a big deal if  the only thing stored in them is an encrypted SID that is only valid  for the specific 30 minutes I am browsing a shopping cart.
Let someone steal my expired cookie, please take it, take it!   It will only be a vulnerability until the session on the server closes or renews, after that time period its garbage data!!!!!!!!  This completely negates some folks statements that cookies are insecure.  Yes, they are insecure if you permanantly  store your medical records in them.  But a random number that only has meaning for 30 minutes (and after that is totally meaningless) and only then if the cracker knows exactly what website to look on in order to hijack a session, well, I dont really see the threat either. The hijacker isnt going to get the CC#  anyway because OSC never stores it and never displays it. The worse the hijacker can do is get or alter personal information like phone numbers and address.  It seems to me the cracker is just as likely to get that particular information directly from the targeted PC rather than from OSC.  Just to be safe, however, the auxiliary cookies (not the SID one, but the
  one with personal info in them) really should be encrypted and keyed to something stored only in OSC's database.   

[quote]
A cookie will never live shorter than this. Even when the lifetime of a cookie is set to 10 min. it will not be deleted until the current browser-session ends.
[/quote]  Given this, I am hoping  perhaps the fields can be blanked if the server expires the session. 

[quote]If you really want to limit php-session-life, you should set the session-timeout-value in php.ini to a lower value. As far as I know it's default is 1440 secs or 24 minutes. This is pretty close to the 20 minutes you would like to see.
[/quote][/quote]
It might be nice for OSC to let the admin set an optional  feature that forces an override  of  this (and perhaps other ini settings). This is so the merchant can tune this if the ASP or integrator does a poor job with php.ini.   My speculation is OSC will eventually reach a target audience of the unwashed masses who have never heard of php.ini or ssh.
But maybe thats OSC 7.0 ;)