[HttpFoundation] Clear invalid session cookie #32455

Toflar · 2019-07-09T09:16:21Z

Q	A
Branch?	4.2 (actually maybe should also go to 3.4, see below)
Bug fix?	yes
New feature?	no
BC breaks?	no
Deprecations?	no
Tests pass?	TODO
Fixed tickets
License	MIT
Doc PR	not required

Currently, invalid session cookies are not cleaned up.

If the session is empty, the AbstractSessionHandler::write() destroys the session. If a new session has been started in the current process (meaning session_start() has sent the Set-Cookie header) then the AbstractSessionHandler will make sure this cookie is not sent to the client. If, however, session_start() did not send a cookie (meaning there was already a valid session ID in your request cookie), the AbstractSessionHandler will clear the session cookie (send a 0-lifetime cookie).
If, however, the request does contain a session ID cookie but it is not valid, session_start() will send a new cookie which is then again cleared by the AbstractSessionHandler. But it will not clear the old cookie sent by the request.

Here's a more complex example of what happens in the code flow when a user logs out and we regenerate a new session id for security reasons:

You have no PHPSESSID cookie yet.
You log into the system, you get a new PHPSESSID assigned. Let's go for session ID 1.
You log out of the system, for security reasons you get session ID 2 regenerated.
The AbstractSessionListener pops in and calls ->save() on your session handler.
The NativeSessionStorage calls the StrictSessionHandler (in fact the abstract parent, AbstractSessionHandler) which write()s the session data. In case the session data is empty, it will actually destroy() the session which means it will invalidate the session cookie. In that case, however, it won't send a 0-lifetime cookie because $cookie = SessionUtils::popSessionCookie($this->sessionName, $sessionId); will not return null. That is because after regeneration we actually do have a Set-Cookie: PHPSESSID=2 header present.
This means, our PHPSESSID=1 cookie is never deleted.

Why is this a problem?
Well, we have an invalid cookie that remains floating around forever. Loads of reverse proxies consider requests with cookies as being private and thus disable caching.

I'm not sure this is the correct fix here but it felt like the only place we can do this because it has to happen during or after $session->save().

Looking for feedback first before we finish this with tests etc.

Regarding Symfony 3.4: Not sure how this is affected because there's not even a SessionUtils class so I'd prefer to leave that fix to somebody who feels more comfortable with that code base 😄

/cc @aschempp

rpkamp · 2019-07-09T12:25:54Z

@Toflar The SessionUtils was actually introduced in this PR: #28168

The code was moved from Symfony\Component\HttpFoundation\Session\Storage\Handler\AbstractSessionHandler to the new SessionUtils because the same functionality was needed twice.

This was just a code re-location though, functionally it did not change.

Toflar · 2019-07-09T12:28:41Z

I see, so should be easy to backport. Not doing that right now, though :) Thanks for the feedback!

nicolas-grekas · 2019-07-10T08:47:49Z

Any way to move this behind $session->save();?

Toflar · 2019-07-10T09:06:52Z

I was thinking the same. We could, indeed for example by changing if (null === $cookie) { to if (null === $cookie || isset($_COOKIE[$this->sessionName])) { here: https://github.com/symfony/symfony/blob/4.4/src/Symfony/Component/HttpFoundation/Session/Storage/Handler/AbstractSessionHandler.php#L127.

However, I was reluctant doing that because Session::destroy($sessionId) would then clear a cookie of a $sessionId that does not match. So it kind of does something that cannot be expected from the method signature. But then again, one can never have two valid PHPSESSID cookies so at this point we know that nobody started the session (= it must be an invalid cookie).

aschempp · 2019-07-10T11:32:45Z

In that case we don't even need to check if a cookie was unset at all 🙃

Toflar · 2019-07-16T08:54:25Z

Anything I can do here so we can get his fixed @nicolas-grekas?
Tbh, I would also prefer to fix it in $session->save().

nicolas-grekas · 2019-07-17T18:10:13Z

let's do it in $session->save()
session handling is full of global side effects anyway.
Please add a functional test also, there is some infra in place already do to so.

Toflar · 2019-07-18T08:42:30Z

src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php

@@ -266,7 +266,7 @@ public function save()
            session_write_close();
        } finally {
            restore_error_handler();
-            $_SESSION = $session;
+            $_SESSION = $session; // TODO: why is $_SESSION restored with the meta data and bag keys here?


@nicolas-grekas So what's happening here is that we copy $_SESSION to $session. Then we unset the meta data bag and other bag keys before we call the save handler. At this moment the session will be empty and thus the session will be invalidated. What's the point of setting the bags to $_SESSION again afterwards?
That looks really strange to me, also when looking into the functional tests. Let's say we check storage.php and storage.expected. Here's what storage.php looks like atm:

<?php $storage = new NativeSessionStorage(); $storage->setSaveHandler(new TestSessionHandler()); $flash = new FlashBag(); $storage->registerBag($flash); $storage->start(); $flash->add('foo', 'bar'); print_r($flash->get('foo')); echo empty($_SESSION) ? '$_SESSION is empty' : '$_SESSION is not empty'; echo "\n"; $storage->save(); echo empty($_SESSION) ? '$_SESSION is empty' : '$_SESSION is not empty'; ob_start(function ($buffer) { return str_replace(session_id(), 'random_session_id', $buffer); });

And this is what storage.expected looks like:

open validateId read doRead: read Array ( [0] => bar ) $_SESSION is not empty write destroy close $_SESSION is not empty Array ( [0] => Content-Type: text/plain; charset=utf-8 [1] => Cache-Control: max-age=0, private, must-revalidate [2] => Set-Cookie: sid=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly ) shutdown

As you can see, I have adjusted storage.expected because it indeed did not invalidate the cookie even though the session was empty. It is empty because the flash bag unsets on the first get(), so that's correct. But what's strange is that after destroy and close we expect $_SESSION is not empty which is of course true at the moment. But that's what makes no sense to me. Why do we restore that? Shouldn't we expect this is really completely empty?

If you remember why this is, I think I'll replace my TODO comment with a comment explaining why we restore the bag keys 😄 But personally I think we should only restore it if $_SESSION is not empty.

I think I know why this is. It's to restore the bags in case there were other keys. That's strange though.
Let me add to this PR on what I think would be correct. Maybe that's easier for you to review then when you can actually see the changes.

Toflar · 2019-07-18T08:44:14Z

Updated the PR. In fact there were already tests that were wrong imho, so I adjusted those 😄
I also noticed something strange. I have left a TODO comment there and commented that line of code separately. Maybe you remember why this was. I did a git blame but seems like this has been in place for ages 😄

Toflar · 2019-07-18T09:47:41Z

There we go, that's how I think it should be. Ready for a review 😄

src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php

src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/Fixtures/storage.expected

Toflar · 2019-07-18T13:07:19Z

Failing tests unrelated.

This PR was merged into the 4.3 branch. Discussion ---------- [Messenger] fix test | Q | A | ------------- | --- | Branch? | 4.3 | Bug fix? | no | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | | License | MIT | Doc PR | fixes a test that was added in the `4.3` branch now that symfony#32700 is merged up Commits ------- 16fc81f fix test

* 4.2: make tests forward compatible with DI 4.4 Fix multiSelect ChoiceQuestion when answers have spaces

* 4.2: relax some assertions to make tests forward compatible fix typo

This PR was squashed before being merged into the 3.4 branch (closes symfony#32800). Discussion ---------- Improve some URLs | Q | A | ------------- | --- | Branch? | 3.4  | Bug fix? | no | New feature? | no  | BC breaks? | no  | Deprecations? | no  | Tests pass? | yes  | Fixed tickets | N/A  | License | MIT | Doc PR | N/A   Commits ------- fab17a4 Improve some URLs

* 3.4: Improve some URLs Fix test compatibility with 4.x components [Cache] cs fix

…sse) This PR was merged into the 3.4 branch. Discussion ---------- [HttpKernel] Fix s-maxage=3 transient test | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | NA | License | MIT | Doc PR | NA sometime the http server returns a `s-maxage=3` header (https://travis-ci.org/symfony/symfony/jobs/569326531) This PR fixes tests to allow both 2 and 3 Commits ------- f019b52 Fix s-maxage=3 transient test

* 3.4: [Intl] use strict comparisons Fix s-maxage=3 transient test

This PR was merged into the 3.4 branch. Discussion ---------- Replace warning by isolated test | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | symfony#32844 | License | MIT | Doc PR | symfony/symfony-docs#...  Failing test introduced in PHP 7.4 (fatal error) were skiped with a warning exception. This PR un tests is isolated process in order to correctly flag the test without stoping the test suite. I kept a comment to the original bug in order to easily remove theme Commits ------- 9c45a8e Replace warning by isolated test

* 3.4: Replace warning by isolated test

…ith/without return typehint (jderusse) This PR was merged into the 4.3 branch. Discussion ---------- [VarDumper] Fix test patern to handle callstack with/without return typehint | Q | A | ------------- | --- | Branch? | 4.3 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | symfony#32844 | License | MIT | Doc PR | NA The TestCase::tearDownAfterClass methods does not always have the same signature which change the output of the reflection. This use another methods for testing Commits ------- feaadd1 Fix tst patern to handle callstack with/without return typehint

fabpot · 2019-08-09T06:54:16Z

Should probably target 3.4 as this is a bug fix.

Toflar · 2019-08-09T07:02:06Z

Regarding Symfony 3.4: Not sure how this is affected because there's not even a SessionUtils class so I'd prefer to leave that fix to somebody who feels more comfortable with that code base 😄

I can have a look at it again but I'd still appreciate it if this would be released with the next 4.3 as it is affecting my projects and already didn't make it in the last 4.2 😊

fabpot · 2019-08-09T07:05:28Z

ok, I missed the comment for 3.4. Let's try to do it on 4.3 then.

fabpot · 2019-08-09T07:08:52Z

Thank you @Toflar.

@aschempp

This PR was submitted for the 4.2 branch but it was squashed and merged into the 4.3 branch instead (closes #32455). Discussion ---------- [HttpFoundation] Clear invalid session cookie | Q | A | ------------- | --- | Branch? | 4.2 (actually maybe should also go to 3.4, see below) | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | TODO | Fixed tickets | | License | MIT | Doc PR | not required Currently, invalid session cookies are not cleaned up. If the session is empty, the `AbstractSessionHandler::write()` destroys the session. If a new session has been started in the current process (meaning `session_start()` has sent the `Set-Cookie` header) then the `AbstractSessionHandler` will make sure this cookie is not sent to the client. If, however, `session_start()` did not send a cookie (meaning there was already a valid session ID in your request cookie), the `AbstractSessionHandler` will clear the session cookie (send a 0-lifetime cookie). If, however, the request does contain a session ID cookie but it is not valid, `session_start()` will send a new cookie which is then again cleared by the `AbstractSessionHandler`. But it will not clear the old cookie sent by the request. Here's a more complex example of what happens in the code flow when a user logs out and we regenerate a new session id for security reasons: 1. You have no `PHPSESSID` cookie yet. 2. You log into the system, you get a new `PHPSESSID` assigned. Let's go for session ID `1`. 3. You log out of the system, for security reasons you get session ID `2` regenerated. 4. The `AbstractSessionListener` pops in and calls `->save()` on your session handler. 5. The `NativeSessionStorage` calls the `StrictSessionHandler` (in fact the abstract parent, `AbstractSessionHandler`) which `write()`s the session data. In case the session data is empty, it will actually `destroy()` the session which means it will invalidate the session cookie. In that case, however, it won't send a 0-lifetime cookie because `$cookie = SessionUtils::popSessionCookie($this->sessionName, $sessionId);` will **not** return `null`. That is because after regeneration we actually do have a `Set-Cookie: PHPSESSID=2` header present. 6. This means, our `PHPSESSID=1` cookie is never deleted. Why is this a problem? Well, we have an invalid cookie that remains floating around forever. Loads of reverse proxies consider requests with cookies as being private and thus disable caching. I'm not sure this is the correct fix here but it felt like the only place we can do this because it has to happen during or after `$session->save()`. Looking for feedback first before we finish this with tests etc. Regarding Symfony 3.4: Not sure how this is affected because there's not even a `SessionUtils` class so I'd prefer to leave that fix to somebody who feels more comfortable with that code base 😄 /cc @aschempp Commits ------- b22a726 [HttpFoundation] Clear invalid session cookie

carsonbot added Status: Needs Review Bug labels Jul 9, 2019

Toflar mentioned this pull request Jul 9, 2019

Session and CSRF cookie not being deleted when logging out contao/contao#551

Closed

nicolas-grekas added this to the 4.2 milestone Jul 10, 2019

nicolas-grekas changed the title ~~Clear invalid session cookie~~ [HttpFoundation] Clear invalid session cookie Jul 17, 2019

Toflar commented Jul 18, 2019

View reviewed changes

nicolas-grekas reviewed Jul 18, 2019

View reviewed changes

src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php Outdated Show resolved Hide resolved

nicolas-grekas reviewed Jul 18, 2019

View reviewed changes

src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/Fixtures/storage.expected Show resolved Hide resolved

nicolas-grekas approved these changes Jul 18, 2019

View reviewed changes

leofeyer approved these changes Jul 23, 2019

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Review labels Jul 23, 2019

xabbuh and others added 8 commits July 24, 2019 18:24

fix test

16fc81f

Merge branch '4.2' into 4.3

d320cbf

* 4.2: make tests forward compatible with DI 4.4 Fix multiSelect ChoiceQuestion when answers have spaces

[Messenger] Fix redis last error not cleared between calls

9c263ff

Merge branch '4.2' into 4.3

327fb95

* 4.2: relax some assertions to make tests forward compatible fix typo

Fix bindings and tagged_locator

bf4c713

Fix pluralizing "season"

bf608aa

[Messenger] expire delay queue and fix auto_setup logic

7aee83a

Arman-Hosseini and others added 6 commits August 8, 2019 17:01

Improve some URLs

fab17a4

Merge branch '3.4' into 4.3

fdf6fc3

* 3.4: Improve some URLs Fix test compatibility with 4.x components [Cache] cs fix

[Intl] use strict comparisons

02a90d2

Merge branch '3.4' into 4.3

38f08ba

* 3.4: [Intl] use strict comparisons Fix s-maxage=3 transient test

nicolas-grekas added the Ready label Aug 8, 2019

jderusse and others added 5 commits August 8, 2019 21:16

Fix tst patern to handle callstack with/without return typehint

feaadd1

Replace warning by isolated test

9c45a8e

Merge branch '3.4' into 4.3

85c5011

* 3.4: Replace warning by isolated test

fabpot approved these changes Aug 9, 2019

View reviewed changes

[HttpFoundation] Clear invalid session cookie

b22a726

fabpot changed the base branch from 4.2 to 4.3 August 9, 2019 07:08

fabpot force-pushed the clear-invalid-session-cookie branch from 10329c7 to b22a726 Compare August 9, 2019 07:08

Toflar requested review from dunglas, lyrixx, sroze and xabbuh as code owners August 9, 2019 07:08

carsonbot added Status: Needs Review and removed Status: Reviewed labels Aug 9, 2019

fabpot merged commit b22a726 into symfony:4.3 Aug 9, 2019

Toflar deleted the clear-invalid-session-cookie branch August 9, 2019 07:09

fabpot mentioned this pull request Aug 26, 2019

Release v4.3.4 #33345

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[HttpFoundation] Clear invalid session cookie #32455

[HttpFoundation] Clear invalid session cookie #32455

Toflar commented Jul 9, 2019

rpkamp commented Jul 9, 2019

Toflar commented Jul 9, 2019

nicolas-grekas commented Jul 10, 2019

Toflar commented Jul 10, 2019

aschempp commented Jul 10, 2019

Toflar commented Jul 16, 2019

nicolas-grekas commented Jul 17, 2019

Toflar Jul 18, 2019 •

edited

Loading

Toflar Jul 18, 2019

Toflar commented Jul 18, 2019

Toflar commented Jul 18, 2019

Toflar commented Jul 18, 2019

fabpot commented Aug 9, 2019

Toflar commented Aug 9, 2019

fabpot commented Aug 9, 2019

fabpot commented Aug 9, 2019

[HttpFoundation] Clear invalid session cookie #32455

[HttpFoundation] Clear invalid session cookie #32455

Conversation

Toflar commented Jul 9, 2019

rpkamp commented Jul 9, 2019

Toflar commented Jul 9, 2019

nicolas-grekas commented Jul 10, 2019

Toflar commented Jul 10, 2019

aschempp commented Jul 10, 2019

Toflar commented Jul 16, 2019

nicolas-grekas commented Jul 17, 2019

Toflar Jul 18, 2019 • edited Loading

Choose a reason for hiding this comment

Toflar Jul 18, 2019

Choose a reason for hiding this comment

Toflar commented Jul 18, 2019

Toflar commented Jul 18, 2019

Toflar commented Jul 18, 2019

fabpot commented Aug 9, 2019

Toflar commented Aug 9, 2019

fabpot commented Aug 9, 2019

fabpot commented Aug 9, 2019

Toflar Jul 18, 2019 •

edited

Loading