Django - sessionid cookie - 这是安全故障吗？

Question

In order to see this possible error you need to open two browsers and some plug-in to get/set cookies.

If you create a new project in django 1.7 and access to the admin site ( /admin ), and login succesfuly in the first broser and get the sessionid and csrftoken cookies and set them into the second browser login page and set a random user and password, you obtain a CSRF error and if you go back in the browser you are logged in.

how can avoid this?

Answer 1

I suppose, you can obtain same result just by copying sessionid cookie to another browser and navigating /admin . You don't need csrftoken to reproduce this issue. It's called sessionid stealing and all frameworks I know are vulnerable to this type of attack.

To avoid it, set SESSION_COOKIE_SECURE = True (default False) to protect your sessionid cookie from man-in-the-middle attacks. You will also need to install ssl certificate on your production server. Then configure it to redirect all http:// requests to https:// . S in https stands for secure , this means all traffic between client and server is encrypted, and no one between client and server (client's ISP, server's hosting provider, proxies, etc) can read any data is sent. Including session cookie value.

And use SESSION_COOKIE_HTTPONLY = True (default) to protect session cookie from stealing via XSS . HTTPONLY means that this cookie will be sent with each http request, but won't be accessible from client's browser via javascript. So if some malware javascript managed to run in client browser, it will not have access to session cookie anyways.

Good tutorial on configuring secure django server can be found here: https://security.stackexchange.com/a/8970