Testing for logout functionality (OWASP-SM-007)
This article is part of the OWASP Testing Guide v4 (the current status is:DRAFT).
OWASP Testing Guide v4 Table of Contents [DRAFT] At the moment the The entire OWASP Testing Guide v3 can be downloaded here.
Session termination is an important part of the session lifecycle. Minimizing the life time of a sessions reduces the probability of the success of session hijacking and other attacks like Cross Site Scripting and Cross Site Request Forgery, which are often targeted against users to access sensible data or functionality which is available in the vulnerable application in authenticated sessions. A secure session termination requires at least the following components:
- Availability of user interface controls for manual logouts performed by the user.
- Session termination after a given amount of time without activity (session timeout).
- Proper invalidation of server-side session state.
Description of the Issue
There are multiple issues which can prevent the effective termination of a session. At the first place the user should be able to terminate the session at every time while usage of the web application. Every page should contain a logout button on a place where it is directly visible. Unclear or ambiguous logout functions could cause that the user don't use it.
Another common mistake in session termination is, that the client-side session token is set to a new value while the server-side state remains active and can be reused by setting the session cookie back to the previous value. Sometimes only a confirmation message is shown to the user without performing any further action.
Users of web browsers often don't mind that an application is still open and just close the browser or a tab. A web application should be aware of this behavior and terminate the session automatically on the server-side after a defined amount of time.
The usage of a single sign-on (SSO) system instead of an application-specific authentication scheme often causes the coexistence of multiple sessions which have to be terminated separately. For instance, the termination of the application-specific session does not terminate the session in the SSO system. Navigating back to the SSO portal offers the user the possibility to relogin back to the application where the logout was performed just before. On the other side a logout function in a SSO system does not necessarily causes session termination in connected applications.
Black Box testing and example
Testing for logout user interface:
Verify the appearance and visibility of the logout functionality in the user interface. For this purpose, view each page from the perspective of an user who has the intention to logout from the web application.
There are some properties which indicate a good logout user interface:
- A logout button is present on all pages of the web application.
- The logout button should be identified quickly by an user which wants to logout from the web application.
- After loading of a page the logout button should be visible without scrolling.
- Ideally the logout button is placed in an area of the page, which is fixed in the view port of the browser and not affected by scrolling of the content.
Testing for server-side session termination:
First, store the values of cookies which are used to identify a session. Invoke the logout function and observe the behavior of the application, especially regarding session cookies. Try to navigate to a page which is only visible in an authenticated session, e.g. by usage of the back button of the browser. If a cached version of the page is displayed, use the reload button to refresh the page from the server. If the logout function causes that session cookies are set to a new value, restore the old value of the session cookies and reload a page from the authenticated area of the application. If these test don't show any vulnerabilities on a particular page, try at least some further pages of the application which are considered as security-critical, to ensure that session termination is recognized properly by these areas of the application.
No data which should be visible only by authenticated users should be visible on the examined pages while performing the tests. Ideally the application redirects to a public area or a login form while accessing authenticated areas after termination of the session.
It should be not necessary for the security of the application, but setting session cookies to new values after logout is generally considered as good practice.
Testing for session timeout:
Try to determine a session timeout by performing requests to a page in the authenticated area of the web application with increasing delays. If the logout behavior appears, the used delay matches approximately the session timeout value.
The same results as for server-side session termination testing described before are excepted by a logout caused by an inactivity timeout.
The proper value for the session timeout highly depends on the purpose of the application and should be a balance of security and usability. In a banking applications it makes normally no sense to keep an inactive session more than 15 minutes. On the other side a short timeout in a wiki or forum could annoy users which are typing lengthy articles with unnecessary login requests. There timeouts of an hour and more can be acceptable.
Testing for session termination in single sign-on environments (single sign-off):
Perform a logout in the tested application. Verify if there is a central portal or application directory which allows the user to relogin to the application without authentication. Test if the application requests the user to authenticate, if the URL of an entry point to the application is requested.
While logged in in the tested application, perform a logout in the SSO system. Then try to access an authenticated area of the tested application.
It is expected that the invocation of a logout function in a web application connected to a SSO system or in the SSO system itself causes global termination of all sessions. An authentication of the user should be required to gain access to the application after logout in the SSO system and connected application.