Unit 4: Cookies and sessions · Lesson 3 of 6 · 20 min

Ending a session

Sign-out has to happen on the server, not just in the browser.

mission

You are
The analyst reviewing the shop's sign-in.
Situation
Staff use the shop on shared counter computers. If sign-out only clears the browser, a copied session value stays useful.
Goal
Sign in, save the session value, sign out and replay the old value.
Hand in
Evidence that shows whether sign-out ends the session on the server.

The test, step by step

0/5
youshop appsession storePOST /loginSet-Cookie: sidGET /logoutdelete sid?GET /account, old sid

Press play or step through.

01

Sign in and note the value

learner@web-lab
curl -s -o /dev/null -c jar.txt -d @shop-account.txt http://127.0.0.1:8000/login
grep shop_session jar.txt | cut -f7
7f3a9c2e41d8b6a5

you should see The session value from the jar.

02

Sign out

learner@web-lab
curl -si -b jar.txt -c jar.txt http://127.0.0.1:8000/logout | grep -iE '^(HTTP|set-cookie)'
HTTP/1.1 303 See Other
Set-Cookie: shop_session=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax
grep -c shop_session jar.txt
0

you should see Max-Age=0 tells the client to drop the cookie, and the jar no longer holds it.

03

Replay the old value

learner@web-lab
curl -s -o /dev/null -w '%{http_code}\n' -b 'shop_session=7f3a9c2e41d8b6a5' http://127.0.0.1:8000/account
200

you should see 200. The server still accepts a session the user signed out of.

defender tip Report this with the three commands as evidence. The fix is to delete the session record on the server at sign-out, then retest.

04

Sign in again

A fresh sign-in should get a fresh value. Compare.

learner@web-lab
curl -s -o /dev/null -c jar2.txt -d @shop-account.txt http://127.0.0.1:8000/login
grep shop_session jar2.txt | cut -f7
7f3a9c2e41d8b6a5

you should see The same value as before. The shop hands every sign-in the same session ID, a second finding.

Sign-out

Shop today
def logout():
    clear_cookie("shop_session")

The browser forgets; the server does not.

Fix
def logout(sid):
    sessions.delete(sid)
    clear_cookie("shop_session")

The old value is dead everywhere.

What a defender takes away

  1. 1Clearing a cookie is not the same as ending a session.
  2. 2Every sign-in must issue a new random session ID.
  3. 3Replay tests give developers evidence they cannot argue with.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.