Access Token Not Expiring After Logout

PreviousInsecure Direct Object Reference NextOWASP A09-Security Logging and Monitoring Failures

Last updated 5 years ago

Was this helpful?

Access Token Not Expiring After Logout

Introduction

The application access token is not expiring after logout.

Impact

An attacker can use the previous access token to perform malicious activities.

How to Test

When click the view to view the record as shown in the below screenshot.

In burp suite, go to proxy tab and go to HTTP history. Then sent the captured above request to the repeater by right click on the packet.

Logged out as shown In the below screenshots

As the token is not expiring after logout we can able to view the record when we send the view request. as shown in the below screenshots

How to Fix

We recommend the following:

The access token should expiry after the logout of user.
Access token should expiry if the user closing the browser without logging out.
Access token should have a defined time-out.

PHP

Sample Code(Logout.php):

<?php 
session_start(); 
session_destroy();                              àIt will destroy all the session variable 
unset($_SESSION["user_name"]);   àit will destroy the particular session variable 
header("location: login.php"); 
?>

Sample Code:

function isLoginSessionExpired() { 
$login_session_duration = 10;  
$current_time = time();  
if(isset($_SESSION['loggedin_time']) and isset($_SESSION["user_id"])){   
if(((time() - $_SESSION['loggedin_time']) > $login_session_duration)){  
return true;  
}  
} 
return false; 
}