[Security] Fix valid remember-me token exposure to the second consequent request #47488
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nicolas-grekas
approved these changes
Sep 5, 2022
There was a problem hiding this comment.
This change looks correct to me.
2 requests come by at the same time with tokenA:
- the one that wins the race persists and sends back tokenB
- the other one accepts tokenA but doesn't send any cookie back, aka tokenB from req 1 stays in the cookie jar.
Unless I missed something, this still fixes the situation that @heiglandreas describes in #46760 while preventing a needless disclosure of the currently valid token to the 2nd request.
/cc @Seldaek in case you want to have a look.
I'm just worried that although this causes a possible security threat, the security disclosure process hasn't been followed appropriately. Please be more careful in the future.
src/Symfony/Component/Security/Http/Tests/RememberMe/PersistentRememberMeHandlerTest.php
Outdated
Show resolved
Hide resolved
…the second consequent request Close symfony#42343 Fix symfony#46760
7e9f27c to
62ceded
Compare
|
Thank you @zerkms. |
This was referenced Sep 30, 2022
Merged
Merged
Merged
|
Throughout the last days I debugged some odd occurrences and was able to track them down to this PR. I will create a new issue for that so that we can track that accordingly. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Close #42343
Fix #46760
#46760 PR together with a fix produces a security vulnerability when a malicious actor may get a new and valid remember me token if makes a request right after the legit user.