[JIRA] Resolved: (SSPCPP-444) Multiple shib_state cookies get set -> server chokes on header field size

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-444?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor resolved SSPCPP-444.
---------------------------------

    Resolution: Fixed

http://svn.shibboleth.net/view/cpp-sp?rev=3638&view=rev

Cookies now include the timestamp along with a random key and are sorted for purging, oldest first, when the count exceeds the value specified in the relayState setting (cookie:n), defaulting to 25.

> Multiple shib_state cookies get set -> server chokes on header field size
> -------------------------------------------------------------------------
>
>                 Key: SSPCPP-444
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-444
>             Project: Shibboleth SP - C++
>          Issue Type: Bug
>          Components: Session Initiation
>    Affects Versions: 2.4, 2.4.1, 2.4.2, 2.4.3
>            Reporter: Lukas Haemmerle
>            Assignee: Scott Cantor
>              Labels: RelayState, cookie
>             Fix For: 2.5
>
>   Original Estimate: 1 day
>          Time Spent: 3 hours
>  Remaining Estimate: 5 hours
>
> The Service Provider sets multiple shib_state cookies in case there is a public web page that does not require a Shibboleth session but that contains URLs to media files (css, images, ...) which point Shibboleth-protected URLs on the same host. In that case the SP will set a shib_state cookie for each request to such a media file. So, if the page contains links to x media files, x shib_state cookies will be set. And hitting reload will set another x cookies. These cookies are also not deleted when the user gets a Shibboleth session for that SP. The result is that the user will accumulate shib_state cookies until he quits the browser (which for some users can take a few days). 
> At some point the browser has set so many cookies for that host that the webserver complains with: 
>     Bad Request
>     Your browser sent a request that this server could not understand.
>     Size of a request header field exceeds server limit.
>     Cookie
> In this state it helps only to quit the browser or delete the cookies for this host in some other way. If the browser allows a third-party cookies, this probably can even be used to "DoS" a remote server. Just lure the user to a page of yours that has many long links to a host where an SP is installed e.g. to https://wiki.shibboleth.net/secure/this/is/a/dummy/link.jpg Depending on how many cookies are set and what maximum header size the webserver on wiki.shibboleth.net has set, the user won't be available anymore to access wiki.shibboleth.net until the cookies are deleted again.
> A proof of concept is (temporarily) available at:
> https://kelimutu.switch.ch/
> Hit reload a few times and then check how many cookies you have set

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira