Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Session ID in URL Rewrite

See original GitHub issue

You want to:

report a bug
request a feature

Current behaviour

socket.io will add ?sid= to the url when trying to connect

Steps to reproduce (if the current behaviour is a bug)

Normal use of socket.io client for javascript

Expected behaviour

Can we move the sid to header ?

Other information (e.g. stacktraces, related issues, suggestions how to fix)

Context: We ran penn test against our socket app using ZAProxy. One of the alert we got is this:

Session ID in URL Rewrite:
URL rewrite is used to track user session ID. The session ID may be disclosed via cross-site referer header. In addition, the session ID might be stored in browser history or server logs.

adding sid to url is problematic according to zaproxy.

my url is like this:

http://localhost:3000/socket.io/?channel=widget&EIO=3&transport=websocket&sid=0JfeAmWw8EceWQkTAAAA

can someone explain the security risk if someone can get other people’s sid ? can it be used to listen/publish or get older messages ? can we move the sid to Header ?

thanks

Issue Analytics

State:
Created 5 years ago
Reactions:7
Comments:7 (2 by maintainers)

Top GitHub Comments

2reactions

nesh-uacommented, May 20, 2021

any news?

0reactions

darrachequesnecommented, Mar 31, 2022

Closed due to inactivity, please reopen if needed.

Top Results From Across the Web

Session ID in URL Rewrite - OWASP ZAP

Session ID in URL Rewrite. Docs > Alerts. Details. Scan Rule Id, 3. Alert Type, Passive. Status, release. Alerts. 3-1 Session ID in...

Url Rewriting - Does that cause a security issue?

When URL rewriting of session cookies is enabled, the URL could be transmitted (with the session identifier) to other sites, resulting in ...

Using URL rewriting for session management

With URL rewriting, all links that are returned to the browser or that get redirected have the session ID appended to them. When...

Session ID in the URL : is it a vulnerability ? | julienprog

When first authenticated, the website reveals in the URL a sensitive information “the session ID”. This is a security risk according to OWASP ......

URL rewriting - Session IDs exposed in the URL - Rapid7

URL rewriting - Session IDs exposed in the URL ; Modified. 10/01/2016 ; Description. The Session Tokens (Cookie, SessionID, Hidden Field), if exposed,...