Access Token Not Expiring After Logout

Introduction

The application access token is not expiring after logout.

Impact

An attacker can use the previous access token to perform malicious activities.

How to Test

When click the view to view the record as shown in the below screenshot.

• Go to the respective site (Eg: http://192.168.43.155/view.php)

• Open Burp suite Community Edition. Here, is the Blog to configuration on your browser.

• In burp suite, go to proxy tab and go to HTTP history. Then sent the captured above request to the repeater by right click on the packet.

Logged out as shown In the below screenshots

As the token is not expiring after logout we can able to view the record when we send the view request. as shown in the below screenshots

How to Fix

We recommend the following:

• The access token should expiry after the logout of user.

• Access token should expiry if the user closing the browser without logging out.

• Access token should have a defined time-out.

PHP

Sample Code(Logout.php):

<?php 
session_start(); 
session_destroy();                              àIt will destroy all the session variable 
unset($_SESSION["user_name"]);   àit will destroy the particular session variable 
header("location: login.php"); 
?> 

PHP Function for Checking Login Session Timeout

Sample Code:

function isLoginSessionExpired() { 
$login_session_duration = 10;  
$current_time = time();  
if(isset($_SESSION['loggedin_time']) and isset($_SESSION["user_id"])){   
if(((time() - $_SESSION['loggedin_time']) > $login_session_duration)){  
return true;  
}  
} 
return false; 
} 

References

https://phppot.com/php/user-login-session-timeout-logout-in-php/