Download as PDF, PPTX
Uploaded byPatrycja Wegrzynowicz
Secure Authentication and Session Management in Java EE
The document discusses secure authentication and session management in Java EE. It begins with an introduction and agenda, then demonstrates four ways to hijack a session: by exposing the session ID in the URL, sniffing network traffic to obtain session cookies, exploiting cross-site scripting vulnerabilities to steal cookies, and performing CSRF attacks using a stolen cookie without directly obtaining it. The document concludes with best practices for secure session management and authentication in Java EE, such as using HTTPS, generating random session IDs, setting secure flags on cookies, and using CSRF tokens.
![[BDD 2025 - Full-Stack Development] Digital Accessibility: Why Developers nee...](https://cdn.slidesharecdn.com/ss_thumbnails/fs-digitalaccessibilitywhydevelopersneedtoknowandcarein2025-251127011019-0674441d-thumbnail.jpg?width=640&height=640&fit=bounds)
Secure Authentication and Session Management in Java EE
- 1.
- 2. (c) Patrycja Wegrzynowicz @yonlabs About Me •15+ professional experience • SoQware engineer, architect, head of soQware R&D • Author and speaker • JavaOne, Devoxx, JavaZone, TheServerSide Java Symposium, Jazoon, OOPSLA, ASE, others • Finalizing PhD in Computer Science • Founder and CTO of Yonita • Bridge the gap between the industry and the academia • Automated detec+on and refactoring of soQware defects • Trainings and code reviews • Security, performance, concurrency, databases • TwiYer: @yonlabs
- 3. (c) Patrycja Wegrzynowicz @yonlabs Agenda •HTTP, session, OWASP • 4 demos to hijack a session • Best prac+ces in Java EE
- 4. (c) Patrycja Wegrzynowicz @yonlabs SecurityStories 2014/2015 #!/bin/bash
- 5.
- 6. (c) Patrycja Wegrzynowicz @yonlabs What is Web Session? •Session iden+fies interac+ons with one user • Unique iden+fier associated with every request • Cookie • Header • Parameter • Hidden field
- 7.
- 8. (c) Patrycja Wegrzynowicz @yonlabs Session Hijacking •Session theQ • URL, sniffing, logs, XSS • Session fixa+on • Session predic+on
- 9. (c) Patrycja Wegrzynowicz @yonlabs Demo: Session Exposed in URL •I will log into the sample applica+on • I will post a link with my session id on TwiYer • @yonlabs • Hijack my session :)
- 10. (c) Patrycja Wegrzynowicz @yonlabs How to Avoid Session Id in URL? •Default: allows cookies and URL rewri+ng • Default cookie, fall back on URL rewri+ng • To embrace all users • Disabled cookies in a browser • Disable URL rewri+ng in an app server • App server specific • Tracking mode • Java EE 6, web.xml
- 11.
- 12. (c) Patrycja Wegrzynowicz @yonlabs Session Sniffing •How to find out a cookie? • e.g., network monitoring and packet sniffing • How to use a cookie? • Browsers’ plugins and add-ons (e.g., Cookie Manager for Firefox) • Intercep+ng proxy (e.g., OWASP ZAP) • DIY: write your own code
- 13. (c) Patrycja Wegrzynowicz @yonlabs Demo: Session Sniffing •You will log into the sample applica+on • Any non empty user name • Please, use meaningful names, the vic+m will get a geecoin! • I will monitor network traffic • tcpdump • I will hijack one of your sessions • Cookie Manager
- 14.
- 15.
- 16.
- 17.
- 18. (c) Patrycja Wegrzynowicz @yonlabs Session Exposure •Transport • Unencrypted transport • Client-side • XSS • AYacks on browsers/OS • Server-side • Logs • Session replica+on • Memory dump
- 19.
- 20.
- 21. (c) Patrycja Wegrzynowicz @yonlabs Demo: Session Grabbed by XSS •JavaScript code to steal a cookie • Servlet to log down stolen cookies • Vulnerable applica+on to be exploited via injected JavaScript code (XSS)
- 22. (c) Patrycja Wegrzynowicz @yonlabs Demo: Session Grabbed by XSS •I will store malicious JavaScript code in the app • Through wri+ng an “opinion” • Log into the vulnerable applica+on • hYps://demo.yonita.com:8181/session-xss/ • Any non empty user name • Please, use meaningful names, the vic+m will get a geecoin! • Click ‚View others opinions’ page • Wait un+l I will hijack your session :)
- 23.
- 24.
- 25. (c) Patrycja Wegrzynowicz @yonlabs Session Fixa+on: Scenario •Hacker opens a web page of a system in a browser • New session ini+alized • Hacker writes down the session id • Hacker leaves the browser open • User comes and logs into the app • Uses the session ini+alized by the hacker • Hacker uses the wriYen down session id to hijack the user’s session
- 26. (c) Patrycja Wegrzynowicz @yonlabs Session Fixa+on: Solu+on •Change the session ID aQer a successful login • more generally: escala+on of privileges • Java EE 7 (Servlet 3.1) • HYpServletRequest.changeSessionId() • Java EE 6 – HYpSession.invalidate() – HYpServletRequest.getSession(true)
- 27. (c) Patrycja Wegrzynowicz @yonlabs Secure Session Management Best Prac+ces •Random, unpredictable session id • At least 16 characters • Secure transport and storage of session id • Cookie preferred over URL rewri+ng • Cookie flags: secure, hYpOnly • Consistent use of HTTPS (How to serve sta+c content?) • Don’t mix HTTP and HTTPS under the same domain/cookie path • Don’t use too broad cookie paths
- 28. (c) Patrycja Wegrzynowicz @yonlabs Secure Authen+ca+on Best Prac+ces •Session crea+on and destruc+on • New session id aQer login • Logout buYon • Session +meouts: 2”-5” for cri+cal apps, 15”-30” for typical apps • Session associated with the headers of the first request • IP, User-Agent,… • If they don’t match, something’s going on (invalidate!)
- 29. (c) Patrycja Wegrzynowicz @yonlabs Secure Authen+ca+on Best Prac+ces cont. •Java EE • Declara+ve authen+ca+on implemented using annota+ons or descriptors • Does not force new session id aQer login (session fixa+on possible, app server specific) • Programma+c authen+ca+on • Java EE 7, Servlet 3.1 • HYpServletRequest: authen+cate, login, logout • Advanced flows and requirements
- 30. (c) Patrycja Wegrzynowicz @yonlabs Secure Authen+ca+on Best Prac+ces cont. •My choice • Programma+c authen+ca+on with Java EE 7 • HYpServletRequest: authen+cate, login, logout • Declara+ve authoriza+on • web.xml • @RolesAllowed, @PermitAll, @DenyAll
- 31.
- 32.
- 33. (c) Patrycja Wegrzynowicz @yonlabs Demo: CSRF to Use a Cookie •I will log into the applica+on • Log into the applica+on • hYps://demo.yonita.com:8181/session-csrf/ • Any non empty user name • Please, use meaningful names, the first vic+m will get a geecoin! • Click the link and the buYon ‘Click me’ • hYps://demo.yonita.com:8181/aYack-csrf/ • I will check my account balance :)
- 34. (c) Patrycja Wegrzynowicz @yonlabs CSRF: Solu+on •Unique token associated with each form • Java EE (JSF): turned on by default • Any other modern framework • Remember about REST/other services
- 35.
- 36.
- 37.
- 38.
- 39.
- 40. (c) Patrycja Wegrzynowicz @yonlabs Q&A •[email protected] • TwiYer: @yonlabs • Upcoming trainings: How to a3ack and secure web apps in Java? Warszawa 15-16.12.2015
