Cookie Security: Session Cookies Disabled

Abstract

程序不使用 cookie 传输会话标识符，这可能导致易受 session fixation 和 session hijacking 攻击。

Explanation

大多数 Web 应用程序使用会话标识符来唯一标识用户，该标识符通常存储在 cookie 中，并在服务器和 Web 浏览器之间进行透明传输。

没有在 cookie 中存储会话标识符的应用程序有时将这些标识符作为 HTTP 请求参数或 URL 的一部分进行传输。接受 URL 中指定的会话标识符使得攻击者很容易进行 session fixation 攻击。

将会话标识符放在 URL 中还会增加针对应用程序进行 session hijacking 攻击的成功几率。当攻击者控制了受害者的活动会话或会话标识符时，就会发生 session hijacking。对于 Web 服务器、应用程序服务器和 Web 代理而言，通常的做法是存储请求的 URL。如果会话标识符包括在 URL 中，那么也会记录它们。增加能够查看和存储会话标识符的位置就会增加被攻击者攻击的机会。

References

[1] Runtime Configuration The PHP Group

[2] Session Fixation OpenText Fortify

[3] Standards Mapping - Common Weakness Enumeration CWE ID 384

[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001664, CCI-001941, CCI-001942

[5] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[6] Standards Mapping - NIST Special Publication 800-53 Revision 4 IA-2 Identification and Authentication (Organizational Users) (P1), SC-23 Session Authenticity (P1)

[7] Standards Mapping - NIST Special Publication 800-53 Revision 5 IA-2 Identification and Authentication (Organizational Users), SC-23 Session Authenticity

[8] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[9] Standards Mapping - OWASP Application Security Verification Standard 4.0 3.2.1 Session Binding Requirements (L1 L2 L3), 3.2.3 Session Binding Requirements (L1 L2 L3), 3.3.1 Session Logout and Timeout Requirements (L1 L2 L3)

[10] Standards Mapping - OWASP Mobile 2014 M9 Improper Session Handling

[11] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[12] Standards Mapping - OWASP Top 10 2004 A3 Broken Authentication and Session Management

[13] Standards Mapping - OWASP Top 10 2007 A7 Broken Authentication and Session Management

[14] Standards Mapping - OWASP Top 10 2010 A3 Broken Authentication and Session Management

[15] Standards Mapping - OWASP Top 10 2013 A6 Sensitive Data Exposure

[16] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[17] Standards Mapping - OWASP Top 10 2021 A07 Identification and Authentication Failures

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.3

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.7

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.10

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.10

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.10

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.10

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[25] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[26] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[27] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[28] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3405 CAT I

[29] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3405 CAT I

[30] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3405 CAT I

[31] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3405 CAT I

[32] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3405 CAT I

[33] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3405 CAT I

[34] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3405 CAT I

[35] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002270 CAT II

[49] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)

[50] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage

desc.structural.php.cookie_security_session_cookies_disabled