Unit 4: Cookies and sessions · Lesson 3 of 6 · 20 min
Ending a session
Sign-out has to happen on the server, not just in the browser.
mission
- You are
- The analyst reviewing the shop's sign-in.
- Situation
- Staff use the shop on shared counter computers. If sign-out only clears the browser, a copied session value stays useful.
- Goal
- Sign in, save the session value, sign out and replay the old value.
- Hand in
- Evidence that shows whether sign-out ends the session on the server.
The test, step by step
Press play or step through.
Sign in and note the value
curl -s -o /dev/null -c jar.txt -d @shop-account.txt http://127.0.0.1:8000/login grep shop_session jar.txt | cut -f7 7f3a9c2e41d8b6a5
you should see The session value from the jar.
curl- Sends web requests and prints the response. Built into Linux, macOS and Windows 10 and later.
grep- Prints the lines of text that match a pattern. Built into Linux and macOS.
cut- Keeps only chosen columns or characters from each line. Built into Linux and macOS.
Sign out
curl -si -b jar.txt -c jar.txt http://127.0.0.1:8000/logout | grep -iE '^(HTTP|set-cookie)' HTTP/1.1 303 See Other Set-Cookie: shop_session=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax grep -c shop_session jar.txt 0
you should see Max-Age=0 tells the client to drop the cookie, and the jar no longer holds it.
Replay the old value
curl -s -o /dev/null -w '%{http_code}\n' -b 'shop_session=7f3a9c2e41d8b6a5' http://127.0.0.1:8000/account
200
you should see 200. The server still accepts a session the user signed out of.
defender tip Report this with the three commands as evidence. The fix is to delete the session record on the server at sign-out, then retest.
Sign in again
A fresh sign-in should get a fresh value. Compare.
curl -s -o /dev/null -c jar2.txt -d @shop-account.txt http://127.0.0.1:8000/login grep shop_session jar2.txt | cut -f7 7f3a9c2e41d8b6a5
you should see The same value as before. The shop hands every sign-in the same session ID, a second finding.
Sign-out
def logout():
clear_cookie("shop_session")The browser forgets; the server does not.
def logout(sid):
sessions.delete(sid)
clear_cookie("shop_session")The old value is dead everywhere.
What a defender takes away
- 1Clearing a cookie is not the same as ending a session.
- 2Every sign-in must issue a new random session ID.
- 3Replay tests give developers evidence they cannot argue with.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.