Need

Securely generate and manage session tokens with appropriate lifespan

Context

• Usage of Dart 2.12.0 for building cross-platform applications
• Usage of Shelf for managing and organizing data in a Node.js application
• Usage of shelf_cookie for managing cookies in a Shelf application

Description

Non compliant code

        import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf_cookie/shelf_cookie.dart';

shelf.Response handleRequest(shelf.Request request) {
  final sessionToken = generateToken();
  final cookie = Cookie('session', sessionToken)..expires = DateTime.now().add(Duration(days: 5));
  return shelf.Response.ok('Hello, World!')
      .change(headers: {'set-cookie': cookie.toString()});
}

String generateToken() {
  // Token generation logic
  return 'token';
}
        
        

In the above code, we have a function handleRequest that handles incoming requests. Inside this function, a session token is generated using the generateToken function.

This session token is then stored in a cookie named 'session'. The cookie is set to expire after 5 days from the current date and time. This is done using DateTime.now().add(Duration(days: 5)).

The cookie with the session token is then added to the response headers and sent back to the client.

The vulnerability here is that the session token has a lifespan of 5 days. This is an insecure practice, as it increases the window in which an attacker can use a stolen session token to impersonate a user. A shorter session token lifespan reduces the time an attacker has to use a stolen token.

Steps

• Reduce the lifespan of the session token to a more secure duration. This could be a few hours or even less depending on the sensitivity of the application.
• Implement a mechanism to refresh the token. This could be done by issuing a new token each time the user interacts with the application, thus keeping the session active while the user is active.
• Consider using a sliding session, where the expiration time is reset after each request. This way, the session will only expire if the user is inactive for the specified duration.
• Implement a mechanism to invalidate the session token on the server side when the user logs out or after a certain period of inactivity.

Compliant code

        import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf_cookie/shelf_cookie.dart';

shelf.Response handleRequest(shelf.Request request) {
  final sessionToken = generateToken();
  final cookie = Cookie('session', sessionToken)..expires = DateTime.now().add(Duration(hours: 2));
  return shelf.Response.ok('Hello, World!')
      .change(headers: {'set-cookie': cookie.toString()});
}

String generateToken() {
  // Token generation logic
  return 'token';
}
        
        

The updated code reduces the lifespan of the session token to a more secure duration of 2 hours. This is a more secure practice as it limits the time window in which an attacker can use a stolen token.

However, this is just one part of the solution. To further enhance the security, consider implementing the following:

- Token Refresh Mechanism: Issue a new token each time the user interacts with the application. This keeps the session active while the user is active, and invalidates the token when the user is inactive.

- Sliding Sessions: Reset the expiration time after each request. This way, the session will only expire if the user is inactive for the specified duration.

- Token Invalidation: Implement a mechanism to invalidate the session token on the server side when the user logs out or after a certain period of inactivity. This ensures that even if a token is stolen, it cannot be used indefinitely by an attacker.

Remember, security is not a one-time thing but a continuous process. Always keep your application updated with the latest security practices and patches.

References

• 322. Insecurely generated token - Lifespan