Lack of data validation - Session Cookie - Scala

Need

Implementation of proper data validation for session cookies

Context

Usage of Scala for building scalable and high-performance applications
Usage of play.api.mvc for handling HTTP requests and building web applications in Play Framework
Usage of play.api.mvc.ControllerComponents for handling HTTP requests and building controllers in Play Framework
Usage of play.api.mvc.BaseController for creating base controllers in Play Framework
Usage of play.api.mvc.Action for handling HTTP requests in Play Framework
Usage of play.api.mvc.Cookie for handling HTTP cookies in Play Framework

Description

Non compliant code

        import play.api.mvc._

class HomeController @Inject()(val controllerComponents: ControllerComponents) extends BaseController {

  def index() = Action { request =>
    val sessionCookie = request.cookies.get("sessionCookie").getOrElse(Cookie("sessionCookie", "defaultValue"))
    Ok("Welcome!").withCookies(sessionCookie)
  }
}

In the above code, we have a Scala Play Framework application with a controller named HomeController. This controller has an action method index() which is supposed to return a welcome message along with setting a session cookie.

The vulnerability lies in the index() method where the session cookie is being set. The code is taking any value sent from the front end in the sessionCookie cookie without any validation. If the sessionCookie cookie is not present in the request, it sets a default value.

                val sessionCookie = request.cookies.get("sessionCookie").getOrElse(Cookie("sessionCookie", "defaultValue"))
Ok("Welcome!").withCookies(sessionCookie)

This presents a security risk as a malicious user can modify the sessionCookie cookie value to something insecure or harmful. Since the application does not validate this value before setting it as a session cookie, it can lead to various security issues like session hijacking, Cross-Site Scripting (XSS), etc.

Steps

Implement server-side data validation for the session cookie value.
Validate the session cookie value against a secure and trusted source.
Use a secure method to generate the session cookie value.
Ensure that the session cookie is encrypted and tamper-proof.
Set the 'secure' flag on the session cookie to ensure it is only transmitted over HTTPS.
Set the 'httpOnly' flag on the session cookie to prevent client-side access.
Implement proper session management and expiration to prevent session hijacking.
Regularly review and update the session cookie validation logic to address any new vulnerabilities or security risks.

Compliant code

        import play.api.mvc._
import play.api.libs.crypto.CookieSigner

class HomeController @Inject()(val controllerComponents: ControllerComponents, cookieSigner: CookieSigner) extends BaseController {

  def index() = Action { request =>
    val sessionCookie = request.cookies.get("sessionCookie").getOrElse(Cookie("sessionCookie", "defaultValue"))
    val signedCookie = Cookie("sessionCookie", cookieSigner.sign(sessionCookie.value), httpOnly = true, secure = true)
    Ok("Welcome!").withCookies(signedCookie)
  }
}

The updated code now includes a secure method to generate the session cookie value. The CookieSigner is used to sign the session cookie value, making it tamper-proof. This ensures that the session cookie cannot be modified by an attacker.

The httpOnly flag is set to true on the session cookie to prevent client-side access. This means that the session cookie cannot be accessed through client-side scripting, which helps to prevent cross-site scripting (XSS) attacks.

The secure flag is also set to true on the session cookie to ensure it is only transmitted over HTTPS. This helps to prevent man-in-the-middle (MITM) attacks where an attacker could intercept the session cookie if it was transmitted over an insecure connection.

The session cookie value is still retrieved from the request, but it is now signed and validated server-side. This means that even if an attacker modifies the session cookie value, it will not match the signed value and will be rejected.

This updated code provides a more secure method of handling session cookies, helping to prevent session hijacking and other potential security vulnerabilities. Regular reviews and updates of the session cookie validation logic are still recommended to address any new vulnerabilities or security risks.

References

190. Lack of data validation - Session Cookie