Re: Plone 3.3.1 __ac cookie and security

Any system that allows users to sign in, use cookies to persist user login.

Make sure to always use ssl when logging in so no one can sniff your
cookies.

Plone uses auth tkt session cookies. It doesn't assign a unique cookie
value for every login session. Many systems are designed this way. Pyramid
probably has better docs about auth_tkt than plone:
http://docs.pylonsproject.org/projects/pyramid/en/1.2-branch/api/authentication.html

On Thu, May 28, 2015 at 7:26 AM, eras mus <[email protected]> wrote:

> Hi,
>
> In an old Plone 3.3.1 during security audit the following was done.
>
> After logging in from login form ,the cookie __ac was captured .
> Then logged out. The logged out message got displayed  on the page.
> Now after injecting the same cookie value in the browser , When site
> is accessed it is showing as logged in.
>
> It is a security threat isn't ? Someone can capture the __ac value and log
> in.
>
> How to overcome this ?(without upgrading to new plone version)
> Please give your valuable suggestions.
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Plone-Users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/plone-users
>



-- 
Nathan Van Gheem
Solutions Architect
Wildcard Corp

------------------------------------------------------------------------------

_______________________________________________
Plone-Users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/plone-users