Need

Secure session management after a password change

Context

• Usage of Java for building robust and scalable applications
• Usage of javax.servlet for building Java web applications with Servlet technology
• Usage of java.io for input and output operations in Java

Description

Non compliant code

        import javax.servlet.*;
import javax.servlet.http.*;
import java.io.IOException;

public class ChangePasswordServlet extends HttpServlet {

    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        String newPassword = request.getParameter("newPassword");
        HttpSession session = request.getSession(false);
        
        if (session != null) {
            User user = (User) session.getAttribute("user");
            if (user != null) {
                user.setPassword(newPassword);
                // Password changed successfully, but the session remains open.
            }
        }
    }
}
        
        

In the above code, the ChangePasswordServlet handles the password change request from the user. The new password is fetched from the request parameters and the current session is obtained. If the session exists, the user object is fetched from the session.

The vulnerability lies in the fact that after the password is changed, the session remains open. This is problematic because if an attacker had previously hijacked the user's session, they would still have access to the user's account even after the password has been changed.

This is known as Insecure Session Management, which is a common web application vulnerability. This flaw can lead to unauthorized users gaining prolonged access to other users' accounts, potentially leading to data theft or other malicious activities.

The proper way to handle this would be to invalidate the session after the password change and force the user to log in again with the new password. This ensures that if an attacker had access to the session, they would be logged out once the password is changed.

Steps

• Implement a session timeout mechanism to automatically invalidate sessions after a certain period of inactivity.
• Upon successful password change, explicitly invalidate the current session to force the user to re-authenticate.
• Generate a new session for the user after the password change to ensure a fresh session is used.
• Consider implementing additional security measures such as using secure session cookies and enforcing strong password policies.

Compliant code

        import javax.servlet.*;
import javax.servlet.http.*;
import java.io.IOException;

public class ChangePasswordServlet extends HttpServlet {

    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        String newPassword = request.getParameter("newPassword");
        HttpSession session = request.getSession(false);
        
        if (session != null) {
            User user = (User) session.getAttribute("user");
            if (user != null) {
                user.setPassword(newPassword);
                // Password changed successfully, now invalidate the session.
                session.invalidate();
                
                // Create a new session for the user.
                HttpSession newSession = request.getSession(true);
                newSession.setAttribute("user", user);
            }
        }
    }
}
        
        

The updated code now includes a mechanism to invalidate the current session after a successful password change. This is done using the invalidate() method of the HttpSession object. This method invalidates the current session and unbinds any objects associated with it.

After invalidating the old session, a new session is created for the user using the getSession(true) method of the HttpServletRequest object. This method returns the current HttpSession associated with this request or, if there is no current session and create is true, returns a new session.

The user object is then reattached to the new session using the setAttribute() method of the HttpSession object. This ensures that the user's session is fresh after a password change, mitigating the risk of session hijacking.

In addition to these changes, it is recommended to implement additional security measures such as using secure session cookies and enforcing strong password policies.

References

• 295. Insecure session management - Change Password