tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #9170 from open-sausages/pulls/4/add-option-to-disable-user-agent-session-check

Browse Source 
API Add option to disable user-agent header session validation
This commit is contained in:
Guy Marriott 2019-08-08 11:47:07 +12:00 committed by GitHub
commit f3132c89d7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 47 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
docs/en/02_Developer_Guides/18_Cookies_And_Sessions/02_Sessions.md
View File

@ -110,6 +110,19 @@ SilverStripe\Control\Session:
This uses the session_name `SECSESSID` for `https` connections instead of the default `PHPSESSID`. Doing so adds an extra layer of security to your session cookie since you no longer share `http` and `https` sessions.
## Relaxing checks around user agent strings
Out of the box, SilverStripe will invalidate a user's session if the `User-Agent` header changes. This provides some supplemental protection against session high-jacking attacks.
It is possible to disable the user agent header session validation. However, it is not recommended.
To disable the user agent session check, add the following code snippet to your project's YML configuration.
```yml
SilverStripe\Control\Session:
strict_user_agent_check: false
```
## API Documentation

10
src/Control/Session.php
View File

@ -144,6 +144,14 @@ class Session
*/
private static $sessionCacheLimiter = '';
/**
* Invalidate the session if user agent header changes between request. Defaults to true. Disabling this checks is
* not recommended.
* @var bool
* @config
*/
private static $strict_user_agent_check = true;
/**
* Session data.
* Will be null if session has not been started
@ -223,7 +231,7 @@ class Session
}
// Funny business detected!
if (isset($this->data['HTTP_USER_AGENT'])) {
if (self::config()->get('strict_user_agent_check') && isset($this->data['HTTP_USER_AGENT'])) {
if ($this->data['HTTP_USER_AGENT'] !== $this->userAgent($request)) {
$this->clearAll();
$this->destroy();

26
tests/php/Control/SessionTest.php
View File

@ -285,7 +285,31 @@ class SessionTest extends SapphireTest
// Verify the new session reset our values
$s2 = new Session($s);
$s2->init($req2);
$this->assertNotEquals($s2->get('val'), 123);
$this->assertEmpty($s2->get('val'));
}
public function testDisabledUserAgentLockout()
{
Session::config()->set('strict_user_agent_check', false);
// Set a user agent
$req1 = new HTTPRequest('GET', '/');
$req1->addHeader('User-Agent', 'Test Agent');
// Generate our session
$s = new Session([]);
$s->init($req1);
$s->set('val', 123);
$s->finalize($req1);
// Change our UA
$req2 = new HTTPRequest('GET', '/');
$req2->addHeader('User-Agent', 'Fake Agent');
// Verify the new session reset our values
$s2 = new Session($s);
$s2->init($req2);
$this->assertEquals($s2->get('val'), 123);
}
public function testSave()